News for hackers. Stuff that matters.

A comment on Disqus Security Alert: User Info Breach. Parent comment

Re:Disqus Security Alert: User Info Breach by markdown on Friday October 06, 2017 @10:42PM (#15421967)
> Salted SHA-1 hashes (salted SHA-anything hashes) were malpractice in 2012.

I'm pretty sure this is still the only option on Google App Engine. You can't upload C code, so bcrypt isn't an option.

[ Parent | on HN ]
Re:Disqus Security Alert: User Info Breach by tptacek on Friday October 06, 2017 @10:51PM (#15422011)
You can't store passwords as salted SHA-x hashes. It's not OK to do that. If you have SHA-anything, you have PBKDF2; use that.
[ Parent | on HN ]
Re:Disqus Security Alert: User Info Breach by Strom on Saturday October 07, 2017 @05:11AM (#15423009)
It has never been the only option on Google App Engine (GAE). Bcrypt is exactly what I used in my GAE app back in 2009, though I have since moved on to scrypt. Bcrypt can be implemented in non-C languages, and there are libraries available for all the languages that are supported on GAE. If you're worried about Python performance, then you can have the bcrypt function in a separate module written in Java/Go.
[ Parent | on HN ]