Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How To Safely Store A Password (2010)

codahale.com

Post reply on HN
Print view View original

11–20 of 65 posts

Re: How To Safely Store A Password (2010)

#11

Post by kemiller2002 »

I always say the best piece of advice on this is, "Don't store passwords." Like shown in other comments, the landscape of what should be used changes frequently. Truthfully, I haven't had to write anything that stores passwords for several years, and until now I hadn't heard of Argon2. That's frightening to me and shows how far out of the game I am now.

Finding a trusted 3rd party who's responsibility is to stay on top of it, is definitely the way to go if you're not in the security space. It's scary how many people don't understand the basics of hashing and encryption that have written authentication systems. When people ask me if we should do something like this, I normally say, "If you're asking me, then you probably already know the answer."

Re: How To Safely Store A Password (2010)

#12

Post by IAmLiterallyAB »

jorge_leria wrote: post #9
Straw wrote: post #2

Bcrypt doesn't have memory-hardness, so has high susceptibility to ASIC attacks. In particular, it incurs the same or lower cost factor on the attacker than the user. More recent designs such as scrypt and Argon2 force high memory usage as well as computation time, incurring little cost on the users but making ASIC and GPU attacks significantly less cost-effective. Of course, any of these will still give better prote…

In general it is is not true that Argon2 should be recommended over bcrypt. Even even some of the people on the experts panel for the PHC (where Argon2 won) won’t recommend Argon2 over Bcrypt: https://twitter.com/TerahashCorp/status/1155129705034653698 Looks like for the typical case (~200ms calculating the hash) bcrypt beats argon2. I guess that’s what I understand from those discussions, I’m not an expert by any me…

Wow. Never heard that before. Would love a proper article on that. I wonder how scrypt holds up

Re: How To Safely Store A Password (2010)

#13

Post by jonathanstrange »

Cryptographic hashing decreases entropy because it is based on a compression function. Most password stretching algorithms are not optimal in that respect, especially if they repeatedly lengthen the plaintext before hashing it again.

There are constructions to avoid this problem but they are not commonly used.

Re: How To Safely Store A Password (2010)

#14

Post by t0astbread »

kemiller2002 wrote: post #11

I always say the best piece of advice on this is, "Don't store passwords." Like shown in other comments, the landscape of what should be used changes frequently. Truthfully, I haven't had to write anything that stores passwords for several years, and until now I hadn't heard of Argon2. That's frightening to me and shows how far out of the game I am now. Finding a trusted 3rd party who's responsibility is to stay on t…

Counterpoint: A dedicated "authentication party" is a privacy nightmare and a single point of failure.

See https://news.ycombinator.com/item?id=25091420

Re: How To Safely Store A Password (2010)

#16

Post by skrebbel »

This blog post was instrumental in convincing large swaths of programmers 10 years ago why normal hashing doesn't cut it. This was in a time that PHP code snippets doing md5($password) were widespread. If people were even hashing passwords at all. It was a time when lots of crypto was hard to use for programmers, and the jargon gap between cryptographers and programmers was even bigger than it was now. A blog post that unambiguously told people what to was uncommon and much needed.

This post truly is internet history. Complaining that there's alternatives today that solve the same problem better than bcrypt is beside the point. The fundamental insight hasn't changed, only the best available algorithm.

Re: How To Safely Store A Password (2010)

#17

Post by kemiller2002 »

t0astbread wrote: post #14
kemiller2002 wrote: post #11

I always say the best piece of advice on this is, "Don't store passwords." Like shown in other comments, the landscape of what should be used changes frequently. Truthfully, I haven't had to write anything that stores passwords for several years, and until now I hadn't heard of Argon2. That's frightening to me and shows how far out of the game I am now. Finding a trusted 3rd party who's responsibility is to stay on t…

Counterpoint: A dedicated "authentication party" is a privacy nightmare and a single point of failure. See https://news.ycombinator.com/item?id=25091420

Very true, there are drawbacks to using 3rd party authentication and I think a good (at least) middle ground is to purchase a hosted appliance that handles storage and authentication. Of course if you are a large organization that can hire people who do know what they are doing, you are golden. Sadly, these are not the companies that I generally interact with.

Re: How To Safely Store A Password (2010)

#18

Post by skrebbel »

OliverJones wrote: post #8

For what it's worth the php implementation of password hashing offers a function to determine whether it's time to rehash a password. https://www.php.net/manual/en/function.password-needs-rehash... The idea is to alert an application program to the need to regenerate the hash at the time it has the plaintext password in hand (when the user has just presented it for login). This is a great idea; rehashing a long-stand…

PHP truly has exemplary built in security functions, other language / standard library teams should look at this in awe. It's pretty unique that a language, among its included batteries, actually makes it easy to correctly not roll your own crypto.

Re: How To Safely Store A Password (2010)

#20

Post by invokestatic »

theandrewbailey wrote: post #10

> Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. https://github.com/P-H-C/phc-winner-argon2

I think argon2 is harder to suggest over bcrypt for a general recommendation since it has more parameters and therefore easier for users shoot themselves in the foot.
Post reply on HN