Reputation
789
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 4 6
Impact
~106k people reached

  • 0 posts edited
  • 0 helpful flags
  • 5 votes cast
Sep
24
awarded  Autobiographer
Nov
12
awarded  Yearling
Nov
12
awarded  Yearling
Nov
12
awarded  Yearling
Aug
26
awarded  Populist
Jul
19
awarded  Critic
Jul
14
awarded  Good Answer
Jun
25
awarded  Nice Answer
Jun
25
awarded  Teacher
Dec
9
awarded  Precognitive
Nov
12
awarded  Supporter
Sep
18
comment Do any security experts recommend bcrypt for password storage?
+1 for mentioning HMAC, which I completely forgot to mention as the more secure alternative to a simply salted SHA-256 hash. Length extension attacks are well known; the Flickr API once was compromised because it used to sign API calls using MD5(secret + argument list) (see " Flickr's API Signature Forgery Vulnerability " [PDF] for further information)
Sep
16
answered Do any security experts recommend bcrypt for password storage?