How to properly store a password in the Database

Posted by pazvanti on Thursday January 28, 2021 @02:19PM
from the petrepopescu.tech dept.

https://petrepopescu.tech/2021/01/how-to-properly-store-a-password-in-the-database/

( 3 comments | 3 points | on HN )

Re:How to properly store a password in the Database by pazvanti on Thursday January 28, 2021 @02:19PM (#25947447)

If anyone has other suggestions or a better way, I am happy to read about it.

[ Parent | on HN ]

Re:How to properly store a password in the Database by franky47 on Friday January 29, 2021 @02:22AM (#25954933)

PBKDF2 is no longer recommended as a hashing algorithm, as it is easy to brute-force it on a GPU. Argon2id is the newest recommended algorithm (watch out for the other variants of Argon2 which are have trade-offs between GPU resistance and side-channel resistance).

If your language of choice does not have a decent, audited implementation of Argon2id, you can go with bcrypt or scrypt, which would be an improvement over PBKDF2, and usually widely available in most languages.

https://en.m.wikipedia.org/wiki/Argon2

https://crypto.stackexchange.com/questions/30785/password-ha...

[ Parent | on HN ]

Re:How to properly store a password in the Database by pazvanti on Friday January 29, 2021 @11:07AM (#25958730)

Thanks. I was not aware that PBKDF2 is no longer recommended.

[ Parent | on HN ]