Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You shouldn't use hash functions designed for integrity, they're fast, fast is bad for password hashing, a single AMD graphics card can compute 200M guesses per second for single sha-512 iterations, instead use bcrypt, scrypr or any other hash function specifically designed for key stretching.

https://hashcat.net/hashcat/

https://en.m.wikipedia.org/wiki/Key_stretching



Yep, I'm using pbkdf2-hmac-sha256 which is not just sha-256. The 2nd link you posted mentions pbkdf2.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: