2 ms·
Adding that salt is optional. I'm pretty sure the author just added it to the post so people know it exists. I don't think it's dumb and pointless at all, real
by bpatrianakos 13y ago
Adding that salt is optional. I'm pretty sure the author just added it to the post so people know it exists.
I don't think it's dumb and pointless at all, really. Generally you wouldn't generate a salt yourself if you're using bcrypt however I'm sure there would be cases where it would be needed or even preferred for some reason. I would advocate for flexibility and education rather than rigidity and simplicity. That is to say, rather than make the function useless to those who'd need their own salt I think it's a better idea to allow these options while making sure developers know that they should only be used in certain situations. A function like this isn't bad because it can be misused.
- masklinn 13y ago> Adding that salt is optional. I'm pretty sure the author just added it to the post so people know it exists. I have nothing against adding a salt manually to show how it works, I have things against adding stupid salts. > I don't think it's dumb and pointless at all, really. You're missing the criticism. The problem isn't the ability to inject a salt (it is useful e.g. when the (cost, salt, hash) triple is in a format other than MCF), it is the way the salt is obtained.