News for hackers. Stuff that matters.

A comment on My First 10 Minutes on a Server. Parent comment

Re:My First 10 Minutes on a Server by kderbe on Wednesday June 15, 2016 @02:25PM (#11911018)
I don't know enough about server security to critique most of that guide, but the Password Security section is clearly behind the times:

> Passwords should always be hashed using a strong, one-way hash algorithm. [...] hashed with an algorithm like SHA-256 7 times.

If they had simply written "just use bcrypt" they'd be much closer to 2016-era security practices.

[ Parent | on HN ]
Re:My First 10 Minutes on a Server by brokenwren on Wednesday June 15, 2016 @03:17PM (#11911382)
BCrypt works fine, but I wouldn't say it is "2016-era security practices". It was written in 1999 and hasn't had as much scrutiny as SHA or Blowfish (although it is based on Blowfish).

Regardless, using a salted, multi-pass algorithm will keep everything nicely secured using nearly any hashing algorithm.

Remember the goal is not to crack one user's password using a brute force lookup table, it is to crack everyone's password.

[ Parent | on HN ]
Re:My First 10 Minutes on a Server by hyperpape on Wednesday June 15, 2016 @10:32PM (#11913556)
BCrypt is apparently just fine in 2016: https://news.ycombinator.com/item?id=11120528.
[ Parent | on HN ]
Re:My First 10 Minutes on a Server by wglb on Thursday June 16, 2016 @09:31AM (#11915920)
It is in fact a 2016-era good security practice.

And it is designed to prevent what your last sentence says.

[ Parent | on HN ]