Disqus Security Alert: User Info Breach

Re:Disqus Security Alert: User Info Breach by sergiotapia on Friday October 06, 2017 @08:27PM (#15421503)

I can only speak to what was mainstream. In my sphere at the time SHA1 was cutting edge, most of my peers were on MD5. The best among us recommending SHA1.

[ Parent | on HN ]

Re:Disqus Security Alert: User Info Breach by tptacek on Friday October 06, 2017 @08:53PM (#15421595)

I don't want to be too much of a jerk about this because I get that this is an expert subject but if the best among you were recommending salted SHA-anything in 2012, the best among you were committing professional malpractice.

Honestly, I feel like when we wrote that dumb bcrypt post in 2007, it was already a bit negligent to be using unstretched general purpose hashes for password storage. The BSD's used better hashes in the 1990s.

[ Parent | on HN ]