6 ms·
#1 - ALWAYS encrypt passwords, no exceptions. Implementing SHA1 salted hashes is trivial. #2 - Dates should be stored in UTC (make sure the server has the time
by Rust 15y ago
#1 - ALWAYS encrypt passwords, no exceptions. Implementing SHA1 salted hashes is trivial.
#2 - Dates should be stored in UTC (make sure the server has the timezone correctly set), and display in the user's TZ or a reasonable default. The language will worry about DST. Don't let SQL touch it (in fact, you should probably store a UNIX timestamp - uint - instead of a datetime).
I would argue the above as "best practice" for storing that info. The douchebag is the developer who won't spend 5 minutes implementing either solution.
- spp 15y agoPlease don't use hashes for this. Use bcrypt (http://en.wikipedia.org/wiki/Bcrypt http://en.wikipedia.org/wiki/Bcrypt). Hashes are designed to be easy to compute, bcrypt is adaptive in the sense that it can be made harder to compute over time, so it's a lot harder to brute force. It also adds a salt by default.
- huxley 15y agoI know I'm being a bit pedantic here, but both bcrypt and SHA1 are cryptographic hash functions. So please, do use hashes for this, just realize that some hashes will be far more secure (like bcrypt) than others (like SHA1 or, FSM-forbid, MD5).