3 ms·
He's saying that if you can't use bcrypt or something like it, you should store passwords in plain text. Like a broken record people like him/her chant "no sec
by markdown 13y ago
He's saying that if you can't use bcrypt or something like it, you should store passwords in plain text.
Like a broken record people like him/her chant "no security at all is better than security by obscurity".
- oakwhiz 13y agoI do not believe that this is what he is trying to say. He does not mean "use plaintext" when he says "don't salt hashes." He means "use a key derivation function."
- jarrett 13y ago> if you can't use bcrypt or something like it, you should store passwords in plain text No, he's saying that if you can't use an acceptable hashing function, you shouldn't store passwords at all. But, why would you be unable to use at least one of the suggested hashing functions, anyway? It's hard for me to imagine a language or platform where none of those functions is available, excluding very simple, special-purpose systems like PLCs.
- markdown 13y agoHave you heard of Google App Engine? You can't use any python module that runs C, which rules out bcrypt and its ilk.