joedaltonwallas

He talks about it as a nightmare wich implies that storing emails/hashes is worse.

I think that storing them is not more difficult, it is more convenient and secure (of course this is relative). But maybe I am missing something about the security of this scheme.

please correct me if I'm wrong: you are not storing passwords, you are storing hashes & salts. One different long random salt for each password.

In my database I store hashes obtained with Blowfish:

http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-stro...

How many tries would you have to do to guess it? And for the other passwords you have to start all over again.

Why people are so frightend of storing the salt & hash of the user password? May be I am mistaken but if the salt is unique for each hash it is almost imposible to recover the original password. Of course you must use a well proven encription library but it is trivial. Am I missing something?