Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That's still not secure, because SHA1 is very fast. To get "secure" from that, you need to iterate the function several thousand times, or use bcrypt.


Or use scrypt, which is far more secure than bcrypt. :-)


Do you have a website or blog entry which explains in detail why using bcrypt is more secure than hash+salt, and how one is supposed to properly store passwords with crypt? Is it because Blowfish is more computationally expensive, and if so, how by how much compared to SHA-1? How does it compare to using larger hashes such as SHA-512 and Whirlpool? Why Blowfish instead of AES?




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: