Re:Enough with the Salts: Updates on Secure Password Schemes
by magicalist on Wednesday April 01, 2015 @06:07PM
(#9307293)
That XKCD doesn't really apply here since you could have easily asked for an explanation without the snark in the first place. There's also a difference between making fun of someone for not knowing something and choosing not to engage with them.
> That was probably a better call than trying to introduce a new term and a new hashing algorithm at the same time; but it's also asking for the exact long-term confusion you're complaining about here
To be fair, besides a basic search for information on the subject, this was also covered in the linked article...
Re:Enough with the Salts: Updates on Secure Password Schemes
by tptacek on Wednesday April 01, 2015 @06:29PM
(#9307414)
He didn't ask snarkily, but we sure are beating this subthread to death. Let's all stop here.
Re:Enough with the Salts: Updates on Secure Password Schemes
by mtrimpe on Thursday April 02, 2015 @04:54AM
(#9309378)
Really? I just reread the article and I couldn't find anything about bcrypt containing the salt as part of its output.
P.S. The XKCD wasn't directed tptacek but at tedunangst who apparently felt my comment made this thread 'astonishingly tedious.'
Re:Enough with the Salts: Updates on Secure Password Schemes
by tedunangst on Thursday April 02, 2015 @05:30AM
(#9309497)
What term? The paper that introduced bcrypt was titled "A Future-Adaptable Password Scheme". The first result, Wikipedia, calls it "a key derivation function for passwords".
As far as I'm concerned bcrypt took the term for a concept that is generally understood to be deterministic (hashing) and redefined it by adding the randomness in by default.
That was probably a better call than trying to introduce a new term and a new hashing algorithm at the same time; but it's also asking for the exact long-term confusion you're complaining about here.