News for hackers. Stuff that matters.

A comment on Ask HN: Why shouldn’t I roll my own password manager?.

Re:Ask HN: Why shouldn’t I roll my own password manager? by atnbueno on Monday July 15, 2019 @08:41AM (#20440216)
Do it. You'll learn a lot. But afterwards you'll switch to an already existing password manager. Mainly because you can't think of everything, and they have years of experience (and frequently external audits). As other commenters have said, not everything is the storage of data.

If you use the appropiated hash functions (PBKDF2, bcrypt, scrypt, not "AES-256") you are not rolling "your own crypto".

[ Parent | on HN ]
Re:Ask HN: Why shouldn’t I roll my own password manager? by brianush1 on Tuesday July 16, 2019 @09:15AM (#20449689)
> If you use the appropiated hash functions (PBKDF2, bcrypt, scrypt, not "AES-256") you are not rolling "your own crypto".

Hash functions are useless in a password manager; you can't retrieve the password after hashing. That's why you use them for storing passwords on the server side, but a password manager needs to know the password so that it can send it to the server.

[ Parent | on HN ]