Okta Bcrypt incident lessons for designing better APIs

Re:Okta Bcrypt incident lessons for designing better APIs by coolgoose on Wednesday February 05, 2025 @04:56PM (#42955830)

But why not bcrypt the password, but sha the cache key on top?

[ Parent | on HN ]

Re:Okta Bcrypt incident lessons for designing better APIs by stavros on Wednesday February 05, 2025 @04:58PM (#42955853)

I guess because they didn't anticipate this flaw.

[ Parent | on HN ]

Re:Okta Bcrypt incident lessons for designing better APIs by masklinn on Wednesday February 05, 2025 @05:03PM (#42955921)

Also prehashing opens you up to an other bcrypt flaw you need to be aware of: it stops at the first NUL byte, so you need to use some sort of binary-to-text encoding on top of the hash to ensure you don't have any of those in the data you ultimately hand off to bcrypt.

[ Parent | on HN ]

Re:Okta Bcrypt incident lessons for designing better APIs by Dylan16807 on Wednesday February 05, 2025 @05:25PM (#42956191)

It's astounding how bad the default API for Bcrypt is.

[ Parent | on HN ]

Re:Okta Bcrypt incident lessons for designing better APIs by coolgoose on Wednesday February 05, 2025 @05:18PM (#42956105)

Thank you

[ Parent | on HN ]