3 ms·
Software library support for bcrypt and scrypt is still light (although there is admittedly more support for the former than the latter). Which would could caus
by atoponce 12y ago
Software library support for bcrypt and scrypt is still light (although there is admittedly more support for the former than the latter). Which would could cause you to roll your own in-house solution. This is less optimal. There is ubiquitous library support for key stretching with fast hashes.
- matthewmacleod 12y agoReally? I'm pretty sure that there's near-ubiquitous support for bcrypt for any language or framework, no?
- tptacek 12y agoName a single widespread environment for which no secure password hash is available.
- atoponce 12y agoMySQL for bcrypt and/or scrypt.
- tptacek 12y agoPlenty of applications built on MySQL use bcrypt. For example: see virtually every Rails app.
- atoponce 12y agoCREATE USER 'tptacek'@'db.example.com' IDENTIFIED BY 'su3rl337P@$sw0rd'; Let me know when MySQL supports bcrypt/scrypt.
- tptacek 12y agoSee comment downthread about "competence".
- tedunangst 12y agoI don't see how this is even relevant. What do MySQL's limitations have to do with your decision to store a password hash? Are you writing your entire application in MySQL?
- ghshephard 12y agoI'm curious - is that a common practice with backend applications - writing only with MySql application code and not using anything else like Java/PHP/Python/C# etc? I know Oracle has pretty sophisticated stored procedures, but even so, most of the application logic of systems I've seen had program code written in an "external" language.
- tptacek 12y agoIn 10 years of consulting with a large team for companies big and small I saw a total of none applications built this way.