4 ms·
The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity
by rfrey 11y ago
The full quote is:
"When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow."
Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?
- atwebb 11y agoI think they're assuming it can be decrypted instead of one-way.
- ad-hominem 11y agoEncryption means encrypting information which can later be decrypted. If you are talking about a one-way transform of data that you can never retrieve the original information from the result of the transformation, that is called hashing. We hash passwords, not encrypt them.
- smt88 11y agoEncryption isn't encryption if it's one-way.
- atwebb 11y agoThanks, I was trying to rephrase it, similar to people using IM in this thread but being off-base with it's actual meaning.
- ovi256 11y agoOf course one shouldn't encrypt them, one should salt and hash them. With a cryptographically secure hash such as bcrypt or scrypt. If you use a batteries-included web-framework, this is already done for you. If you do not, you better understand the tradeoff of redeveloping those parts.
- mcdougle 11y agoI imagine the OP probably meant that and simply wrote the wrong thing in the post. I probably wouldn't have noticed it was the wrong wording if not for this comment chain.
- woah 11y agoThe only acceptable advice in this situation is "use bcrypt". Vague stuff about "hashing or encrypting" is not good enough.
- baby 11y agoand if you're salting them yourself you're doing things wrong, use a good library that takes care of these little crypto details for you.
- mgolawala 11y agoThat is correct. You should not store passwords in any form ... even encrypted. You should either store only the salted hash value, or outsource the identity management to a third party who knows not to store the users passwords. :)