New answers tagged

6

PBKDF2, scrypt and bcrypt are all configurable; they can be made as slow as you want. The limiting point is not the computer, but the user's patience. For example, suppose that the user will go irate if the password processing (e.g. to unlock an archive file) takes more than 6 seconds. If you use bcrypt only, then you can tune it up so that it takes 6 ...


0

Highly dependent. After a certain point encryption just doesn't become worth it. No matter how secure you can make it. Just because technique X is more secure than technique Y if the data ever gets stolen is a horrible argument for it because in the first place you should have had the proper security in place to make sure it couldn't be stolen in the first ...


-1

I have learned a lot with this thread, so I thought in a way to easily understand the possible outcome when combined different methods (of course, it won't fit all cases): [W=weak, S=strong]: Formula | Example ---------------|----------------- W(W) = W | md5(sha1(pwd)) W(S) = W | md5(bcrypt(pwd)) S(W) = W | bcrypt(md5(pwd)) S(S) = ...



Top 50 recent answers are included