5 ms·
what I would have naturally done without anticipating any flaw (and probably be just OK): cache_key = sha(sha(id + username) + bcrypt(pass)) with sha256 or
by sscarduzio 2y ago
what I would have naturally done without anticipating any flaw (and probably be just OK):
cache_key = sha(sha(id + username) + bcrypt(pass))
with sha256 or something.
- throwaway-9111 2y agoWhy not a simple sha(id + username + bcrypt(pass)) Is there any security issues with that? I'm a "newb" in this area, so I'm genuinely curious about the flaws with the naive approach