Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You can also use e.g. BLAKE2 which is at least as fast as MD5, while still being cryptographically strong. Win-win.


Nice BLAKE2 article from HN in March, 2014

https://leastauthority.com/blog/BLAKE2-harder-better-faster-...


For hashing passwords, you want something slow, not fast.


Who said anything about hashing passwords? But this is a misconception. You don't want a primitive that is slow. You want one that gives you a lot of security margin in few cycles, then you make it slow by, for instance, iterating it many times. There are many password hashing schemes based on BLAKE2, 6 different ones submitted to PHC (https://password-hashing.net/).


It's sadly common for inexperienced devs to use MD5 and call it a day (if they hash at all).

I just wanted to point out that, for situations where user input and security are important, you want the algorithm to be slow.

I didn't say anything about how to implement it or whether you should use BLAKE2 or what. There's a lot more to it than I could put in a reply here, and even quick Googling would turn up info about salting/iterating/etc.


Thanks for BLAKE2




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: