Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

`bcrypt` is probably the "standard" in the sense that it has the widest adoption, but since 2015 [1] the "standard" in terms of what you should recommend for new work has been `argon2id` (and you can find parameter recommendations here [2]).

[1] https://en.wikipedia.org/wiki/Password_Hashing_Competition

[2] https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...



Also argon doesn't care about input length compared to bcrypt which only ever compares the first 72 bytes of a hash. Okta actually fell victim to this because they concatenated userid + username + password. If userid + password were over 72 bytes then the password would never be checked thus you could login with userid + username.

https://trust.okta.com/security-advisories/okta-ad-ldap-dele...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: