Hacker News Reader

We hash the password using pbkdf2. The actual code looks like this:

crypto.pbkdf2(text, salt, ITERATIONS, BYTES, function...

ITERATIONS is 1000, and BYTES is 32.

Our code is descended from the code on this page: http://www.thejoyofcode.com/Exploring_custom_identity_in_Mob...

That's great; it's the answer I quietly predicted I'd get. If you're communicating to laypeople, you can say something like "we use a modern secure password hash".

Note, if your crypto.pbkdf2() is using SHA1 underneath, then 1,000 interations of SHA1 is very little computation for a GPU, which can do billions of SHA1 per second.

Also, asking for 32 bytes from PBKDF2-HMAC-SHA1 has some bad side-effects, particularly if you are splitting up the result. (1Password got bitten by this, and wrote up the issue here: http://blog.agilebits.com/wp-content/uploads/2013/07/playing...)

If by "bitten by this" you mean "had their security reduced by 1 bit", then sure.

I remember it feeling like a bigger deal reading about it at the time, but as you say, you're just throwing away half of the stretching, reducing attack cost by half.

Reply on news.ycombinator.com