Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Why Not {MD5, SHA1, SHA256, SHA512, SHA-3, etc}?

These are all general purpose hash functions, designed to calculate a digest of huge amounts of data in as short a time as possible."

See the rest here: http://codahale.com/how-to-safely-store-a-password/



designed to calculate a digest of huge amounts of data in as short a time as possible.

That's a weakness, not a strength. If you can only calculate 100 hashes per second, it will take a lot longer to crack a password than if you can calculate 100 000 hashes per second.


That's the point of that article, use bcrypt because it's slow.


Misinterpreted the parent post. Thanks for the correction.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: