[geeklog-devel] Password Hashing
vfuria at gmail.com
Tue Dec 14 02:19:26 EST 2010
Just caught this "article":
TL;DR: It recommends using bcrypt (a variant of Blowfish encryption) to hash
For those who want details,
http://www.usenix.org/events/usenix99/provos/provos_html/node1.html is a
very detailed paper about the security of using bcrypt for password hashing.
There is a "Portable PHP password hashing framework" that supports bcrypt:
If we're going to move to something more secure than MD5 or SHA1 (and
its derivatives) for our password hash, we might as well move to something
with some built in future proofing.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the geeklog-devel