4 ms·
bcrypt is the industry standard.
by scq 11mo ago
bcrypt is the industry standard.
- maxbond 11mo ago`bcrypt` is probably the "standard" in the sense that it has the widest adoption, but since 2015 [1] the "standard" in terms of what you should recommend for new work has been `argon2id` (and you can find parameter recommendations here [2]). [1] https://en.wikipedia.org/wiki/Password_Hashing_Competition https://en.wikipedia.org/wiki/Password_Hashing_Competition [2] https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
- tom1337 11mo agoAlso argon doesn't care about input length compared to bcrypt which only ever compares the first 72 bytes of a hash. Okta actually fell victim to this because they concatenated userid + username + password. If userid + password were over 72 bytes then the password would never be checked thus you could login with userid + username. https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/ https://trust.okta.com/security-advisories/okta-ad-ldap-dele...