What should be used instead
For password hashes, looks like Argon2 https://doc.libsodium.org/password_hashing
For generic data, they're still using BLAKE2b as the default, not BLAKE3. Not sure why. Too new? https://doc.libsodium.org/hashing/generic_hashing
SHA256 and SHA512 alone are not awful, but they're slower than BLAKE3 and vulnerable to length extension.
You can add extra tricks to protect them from length extension, like a length prefix or like doing SHA512/256, but it's better not to add tricks to your crypto.
bcrypt is a password hash. It's optimized to defend against brute-force attacks on a short secret string -- which means it's slow (tens to hundreds of milliseconds), and it doesn't support inputs longer than 72 bytes at all.
SHA256 and the BLAKE family are designed for hashing larger bodies of data. They're fast (~5 CPU cycles per byte) and can handle an arbitrarily long input.
general hashes are to be used in other crypto constructions. Or, if you really need just a quick hash (but really think if you really need it.)
Password hashes are for passwords.
It's important to know that this currently isn't true for small inputs for SHA256 when using a cpu with dedicated instructions for it.
I think this is only relevant if you're using a hash as a MAC, in which case you should be using HMAC-SHA256 instead which is not vulnerable to length extension attacks
That is why I think they’ll put more effort into exploiting badly written smart contracts than the underlying blockchain.
Ethereum projects get hacked every day, hackers make millions, but no one loses faith. More of a gravy train.
Really you need someone with a mission to crack bitcoin, not someone looking just to make money.
depends on what you mean by crack.
Although it is definitely better than SHA1, the improvement is ever so slightly:
SHA1 : ec1623b7a94ed3d8feaffaf7580df3eca4f5f5ca
SHA256 : e2b0c44298fc0c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Your question is best answered by asking more questions. What are you doing with the hash is probably the first question. Depending on the answer will go a long way to helping pick an algo that provides the most appropriate when considering security vs expense/time to hash
I think I’ve seen Gentoo’s portage use multiple.
Technically yes, but it takes extra time to hash something twice and it will take extra storage to store 2 hashes. This trade off is not really worth it compared to just using a good hash function alone.