3 ms·
tptacek, I am not trolling. If you can show me an instance where anyone, ever, has successfully brute forced a properly set up (salted AND peppered) hashed pass
by sho 17y ago
tptacek, I am not trolling. If you can show me an instance where anyone, ever, has successfully brute forced a properly set up (salted AND peppered) hashed password from ONLY the hash and the salt then I will quite literally eat my hat. It simply cannot be done with current technology and no amount of rank-pulling will change that.
However, I've actually changed my mind and conceded defeat on this one. If the attacker could grab a copy of the app code as well and get the pepper & hashing setup, bcrypt would indeed slow down the ensuing attack on the passwords. You're basically screwed by then, of course, but it would be nice for the users if they had a little while longer to change their passwords on other sites.
I'll be using bcrypt from now on.
- tptacek 17y agoYou're not even reading my comment before responding to it. Focus your attention on the part about how the attack bcrypt defeats was the sole attack used against Unix passwords for an entire decade, the basis for two of the most popular security tools of all time, and the reason we have shadow passwords. Also, there's no such thing as "pepper", despite what the PHP forums may say. If you weren't deliberately misleading developers into using insecure code patterns, I'd just ignore you, sho.