Hacker News Reader

> most software in the world uses a basic hash like MD5 or SHA-256 rather than a key derivation function

For passwords? Where do you get that information?

Experience? Looking at codebases? The one in question does, in fact, use SHA-256. HN is a bit of a bubble because there's a large demographic of FAANG-tier employees here who work at big tech or unicorn startups, but most software in the world is not made by FAANG or unicorn startups, and the standards are way, way lower than you might think they are if you're used to living in this bubble. For software development practices in general, not just password storage. I think it's taken for granted that every single person on HN uses VCS, but even that is a luxury in many real-world working environments outside of SV.

Even if only 10% of the services you use use MD5/SHA-256 (although I certainly would expect it to be >50% if we could do a large-scale study), why accept your password being easily compromised 10% of the time?

>why accept your password being easily compromised 10% of the time?

Those services using md5 aren't doing important things, I hope, so the password for that service hardly matters.

If it does matter, then user long passwords/phrases and rotate every time (or find a better supplier).

Reply on news.ycombinator.com