Hacker News Reader

Comment by rfrey | Hacker News Reader

The full quote is:

"When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow."

Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?

View on HN

Of course one shouldn't encrypt them, one should salt and hash them. With a cryptographically secure hash such as bcrypt or scrypt.

If you use a batteries-included web-framework, this is already done for you. If you do not, you better understand the tradeoff of redeveloping those parts.

I imagine the OP probably meant that and simply wrote the wrong thing in the post. I probably wouldn't have noticed it was the wrong wording if not for this comment chain.

The only acceptable advice in this situation is "use bcrypt". Vague stuff about "hashing or encrypting" is not good enough.

Wait, what about "scrypt"? Maybe the only acceptable advice changed in the last hour? :-)

Bcrypt is a very easy to use hashing tool that exists in all popular languages. It is the best choice, and the easiest to implement.

and if you're salting them yourself you're doing things wrong, use a good library that takes care of these little crypto details for you.

That is correct. You should not store passwords in any form ... even encrypted.

You should either store only the salted hash value, or outsource the identity management to a third party who knows not to store the users passwords. :)

I think they're assuming it can be decrypted instead of one-way.

Encryption isn't encryption if it's one-way.

Thanks, I was trying to rephrase it, similar to people using IM in this thread but being off-base with it's actual meaning.

Encryption means encrypting information which can later be decrypted. If you are talking about a one-way transform of data that you can never retrieve the original information from the result of the transformation, that is called hashing. We hash passwords, not encrypt them.

Reply on news.ycombinator.com