Somebody else posted a question about ghostmail (https://www.ghostmail.com/crypto) and whether it looks valid. One of the things that triggered alarm bells for me was the sentence "Account Password (This is sent and stored encrypted using BCRYPT)". Do they simply not know the difference between hashing and encryption, or is there actually a way to encrypt a password with BCRYPT?
In that case, it is probably the password hashing function bcrypt, described by someone who does not make the difference between "hashing" and "encryption". Bad terminology, good function.
It must be said that there is an encryption tool called bcrypt as well, and which is known to do things very poorly, as far as encryption tools go. This is occasionally the source of great confusion.
I am replying on behalf of GhostMail.
First of all we are sorry for the possible confusion.
The misunderstanding related to encryption vs hashing using the BCRYPT algorithm has been corrected on our website.
As pointed out by Oasiscircle they are obviously two different things for different purposes.
BCRYPT is a key derivation function used to compute a cryptographic hash of a password to store in some database.
It is worth noting that in this case the "Account Password" itself is a cryptographic hash computed at the client side using PBKDF2 and SHA-256 as the hashing algorithm and which performs 5000 rounds of hashing. This technique is also called key stretching.
If any further questions about our crypto design we will be happy to assist.