Re:Opensubtitles.org breached – Email addresses, IP addresse...
by joren485 on Wednesday January 19, 2022 @06:30AM
(#29992352)
Hybrid (Argon2id) is probably the safest bet if you are unsure.
The specific modes are useful dependent on the threat model you are protecting against. Argon2i protects better against timing/side-channel attacks and Argon2d protects better against brute-forcing attacks.
In my opinion, a developer should (in most cases) focus on application security instead of picking the perfect hashing algorithm, as application security is far more crucial.
I haven't had to write any password storage code since before Argon2 won the 2015 competition so I haven't gone deep on the "side channel attack vs. memory hardness" tradeoff question when picking the mode. I am curious which mode others are using.