How crackers ransack passwords like “qeadzcwrsfxv1331”

Re:How crackers ransack passwords like “qeadzcwrsfxv1331” by markdown on Tuesday May 28, 2013 @08:12PM (#5783738)

> And you should still be using bcrypt. (Or PKBDF2, or scrypt, whatever. Just not something where a "pepper" actually ends up mattering.)

As I said, you can't use any of these on Google App Engine. They're not provided by the platform, and you can't upload them yourself because they use C.

[ Parent | on HN ]

Re:How crackers ransack passwords like “qeadzcwrsfxv1331” by eropple on Wednesday May 29, 2013 @04:26PM (#5788850)

Right, so, like I said, don't use deficient platforms. Your users' security is more important than your ease of use.

And 'peppers' don't do anything of significant value in such an environment, either, because your app's going to get owned before your database is.

[ Parent | on HN ]