Re:GitHub commit search: “remove password”
by Nahjil567 on Wednesday February 15, 2017 @03:33PM
(#13655124)
What hashing algorithms are you using? Are you updating that hashing algorithms as cipher-suites are being broken? Are we as a user required to set a random seed? Just because it is encrypted doesn't mean it is impossible to decrypt. Especially if default settings in the hash are being used and someone uses a poor password found in another breach. Its a great idea, but I would still worry about security issues around publishing a password hash.
[ Parent
| on HN ]
Re:GitHub commit search: “remove password”
by ComputerGuru on Thursday February 16, 2017 @12:56AM
(#13658026)
High level APIs are used for all crypto. The user does not have to generate their own seed. You can use your own key file or stretch a secret phrase once to create one with the library. Passwords are otherwise not hashed, only encrypted.