Re:Please stop hashing passwords
by triangleman83 on Tuesday April 22, 2014 @08:37AM
(#7627243)
Hashing a hash is not generally considered secure because you have to assume that if your system was compromised, the hackers will know what methods you used, including the list of salts. If the hash runs quickly then you didn't really cause them any more time/work.
[ Parent
| on HN ]
Re:Please stop hashing passwords
by danielweber on Tuesday April 22, 2014 @11:28AM
(#7628241)
Assuming "several iterations" means "a million or more iterations" then you have captured most of what bcrypt gets you. You've broken their rainbow tables and they have to brute-force to find users using "passw0rd". You can tune the "several iterations" the same way you can tune bcrypt.
That said, don't roll your own. You probably screwed it up somewhere. Just use the bcrypt library call. Or scrypt to let you roll +2 against GPU attacks.