A Really Good Article on How Easy it Is to Crack Passwords

Re:A Really Good Article on How Easy it Is to Crack Passwords by Freaky on Thursday September 05, 2013 @09:25AM (#6333984)

> there's a ruby gem that only works on MRI but doesn't support jruby

Works as well as any other MRI extension, which is to say pretty well:

    jruby-1.7.4 :001 > require 'scrypt'  
     => true   
    jruby-1.7.4 :002 > SCrypt::Password.create("bla")  
     => "400$8$2d$096ac4e8a120a4f9$d1e13bbfa387196d68f116d76ae23d0d3ffa39c891192a56832db0a1d8f6a8ec"

Yay for ffi.

[ Parent | on HN ]

Re:A Really Good Article on How Easy it Is to Crack Passwords by Xylakant on Thursday September 05, 2013 @09:57AM (#6334179)

Well, C-Extension support in jruby is wonky at best. It works for some and doesn't for others and is sometimes scheduled to be removed. Granted, this one works, I stand corrected. There's a full java implementation for scrypt as well. However, my point still stands: There's no integration in devise, none in rails. No PHP implementation.

It's all fairly easy to change, but nobody has done so :)

[ Parent | on HN ]

Re:A Really Good Article on How Easy it Is to Crack Passwords by Freaky on Thursday September 05, 2013 @10:24AM (#6334351)

Devise: https://github.com/capita/devise-scrypt PHP: http://pecl.php.net/package/scrypt

So not quite "none", though granted being some random third party addon might as well be for many people (and possibly a good attitude to take for something security-critical).

[ Parent | on HN ]

Re:A Really Good Article on How Easy it Is to Crack Passwords by Xylakant on Thursday September 05, 2013 @10:34AM (#6334438)

ok, my original statement regarding PHP was:

> There's no officially blessed language binding for PHP.

And judging from https://github.com/DomBlack/php-scrypt/issues/9 that's going to stay like that a while. There's a pure PHP implementation that falls back to the pecl package, so that's probably your best bet atm.

[ Parent | on HN ]