News for hackers. Stuff that matters.

A comment on Weblog.sh – hosted blogging from the command-line. Parent comment

Re:Weblog.sh – hosted blogging from the command-line by vruiz on Tuesday November 24, 2015 @07:16AM (#10620298)
"pathetic" is a bit harsh. Yes, one should be using b/scrypt nowadays but at least he's using salt and sha256 it's not md5. It could be better, but it could also be much worse.
[ Parent | on HN ]
Re:Weblog.sh – hosted blogging from the command-line by iancarroll on Tuesday November 24, 2015 @08:12AM (#10620458)
sha256 is not "better" than MD5 for password hashing; they're both incredibly fast to brute force and both not meant for password hashing. bcrypt/scrypt, configured correctly, are much slower and much more secure.
[ Parent | on HN ]
Re:Weblog.sh – hosted blogging from the command-line by feld on Tuesday November 24, 2015 @09:42AM (#10620952)
salt adds a minor hurdle and that's it.
[ Parent | on HN ]