7 ms·
Hashing a hash is not generally considered secure because you have to assume that if your system was compromised, the hackers will know what methods you used, i
by triangleman83 12y ago
Hashing a hash is not generally considered secure because you have to assume that if your system was compromised, the hackers will know what methods you used, including the list of salts. If the hash runs quickly then you didn't really cause them any more time/work.
- baby 12y agoThat's right! KDF seems to be better than hashing in the case the server gets compromised.
- danielweber 12y agoAssuming "several iterations" means "a million or more iterations" then you have captured most of what bcrypt gets you. You've broken their rainbow tables and they have to brute-force to find users using "passw0rd". You can tune the "several iterations" the same way you can tune bcrypt. That said, don't roll your own. You probably screwed it up somewhere. Just use the bcrypt library call. Or scrypt to let you roll +2 against GPU attacks.