Skip to content

Comment on Update on Tuts+ Premium Security Breachparent

Comments

Virtually no-one implements bcrypt themselves. If you use a bcrypt library, you don't need to think about salting. Therefore, when someone says "they're using individually salted passwords", you can usually count on the fact that they're using a crappy password hash, but that they think they're doing something cryptographically sophisticated.

Not really related, but the popular python library for bcrypt kind of does make you have to think about salting. (And it has some other, er, 'curious' design decisions as well)

http://www.mindrot.org/projects/py-bcrypt/

So does popular ones for .NET, Java, JavaScript.. I haven't seen one where the work factor is explicitly set in the homepage example yet, though.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.