3 ms·
> And you should still be using bcrypt. (Or PKBDF2, or scrypt, whatever. Just not something where a "pepper" actually ends up mattering.) As I said, you can't
by markdown 13y ago
> And you should still be using bcrypt. (Or PKBDF2, or scrypt, whatever. Just not something where a "pepper" actually ends up mattering.)
As I said, you can't use any of these on Google App Engine. They're not provided by the platform, and you can't upload them yourself because they use C.
- eropple 13y agoRight, so, like I said, don't use deficient platforms. Your users' security is more important than your ease of use. And 'peppers' don't do anything of significant value in such an environment, either, because your app's going to get owned before your database is.