Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Long story short, if a bcrypt exploit is found, you'll be sorry. So use http://en.wikipedia.org/wiki/PBKDF2 or http://www.tarsnap.com/scrypt.html instead. They're apparently better tested.

I'm no expert opinion, but seems a bit unnecessary and that bcrypt is still a perfectly good choice for most password stores.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: