News for hackers. Stuff that matters.

A comment on Coding Horror: You're Probably Storing Passwords Incorrectly. Parent comment

Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @11:18AM (#55706)
If you have to reason through or alter what you're currently doing with passwords, it's irresponsible of you to be storing passwords at all. Like it or not, your users are using the same password for your web 2.0 recipe sharing program as they are for their bank account.

Lesson: use someone else's (good) password system.

[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by bct on Monday September 17, 2007 @05:56PM (#55917)
Better yet, use OpenID and let somebody else worry about passwords.

(ok, this isn't an option for everybody yet)

[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by gwenhwyfaer on Monday September 17, 2007 @02:17PM (#55819)
Is there a list of these somewhere? Which ones would you recommend?
[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @02:44PM (#55834)
If you ship on Unix, use what your operating system ships with. Failing that, use bcrypt, or PHK's MD5 scheme. If you must DIY, iterate the hash function several thousand times.
[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by davidw on Monday September 17, 2007 @12:13PM (#55742)
> Lesson: use someone else's (good) password system.

Ok, what? I use Ruby on Rails, and I want something open source. What do you recommend?

[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @12:26PM (#55748)
Acts_as_authentable uses bcrypt.
[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by aston on Monday September 17, 2007 @11:25AM (#55712)
If your bank only uses a username/password combo to confirm your identity online, you need a new bank.
[ Parent | on HN ]
Re:Coding Horror: You're Probably Storing Passwords Incorrectly by thomasptacek on Monday September 17, 2007 @11:29AM (#55716)
If you use the same password for your web 2.0 recipe account as your bank, etc, etc, etc. We shouldn't rationalize this stuff. All I'm saying is, don't make mistakes with your password system; use someone else's (good) password scheme.
[ Parent | on HN ]