News for hackers. Stuff that matters.

A comment on How to Safely Store Your Users' Passwords in 2016. Parent comment

Re:How to Safely Store Your Users' Passwords in 2016 by zwily on Wednesday February 17, 2016 @12:30PM (#11119500)
Does that library do the calculations in a thread pool, or is it just async on the main thread? If the latter (which seems mostly likely), then it won't matter.
[ Parent | on HN ]
Re:How to Safely Store Your Users' Passwords in 2016 by warfangle on Wednesday February 17, 2016 @12:57PM (#11119738)
It looks like that one is pure JS, using native node crypt functionality for randomness.

The one recommended in the article[0] actually includes a blowfish C++ binding, with both synchronous and asynchronous methods for comparing and hashing. That binding uses NAN[1] to queue AsyncWorkers. NAN uses libuv[2] behind the scenes to launch a thread[3].

0. https://www.npmjs.com/package/bcrypt

1. https://github.com/nodejs/nan

2. https://github.com/libuv/libuv

3. https://blog.scottfrees.com/building-an-asynchronous-c-addon...

[ Parent | on HN ]
Re:How to Safely Store Your Users' Passwords in 2016 by phpnode on Wednesday February 17, 2016 @12:44PM (#11119623)
It does it on the main thread, pseudo-async, so I agree with you, you should not use this library. Look for a native module instead.
[ Parent | on HN ]