Yes. Scrypt can be used securely. There are two sources of potential security problems: weaknesses in the algorithm design and errors in the implementation.
The design of scrypt is relatively simple, so implementation errors will be the only thing that could shock us at this point.
(Issues like buffer overflows, parsing mistakes, or use-after-free bugs. These are things to look out for, but they're not things particular to password hashing code. You are far more likely to find dangerous bugs in your operating system, web server, browser, or OpenSSL.)
As for algorithm weakenesses, there is no question that scrypt is better than bcrypt or PBKDF2. There is just one problem that makes it unsuitable for basic web app authentication. It was designed to be a key derivation function used for file encryption. It's not flexible enough for other uses, where time or memory may be more scarce.
That's why the password hashing competition was held. To improve upon scrypt. Developers should be incorporating Argon2 v 1.3 into new projects and should plan to make upgrades possible if they're curently using an older algorithm. (The only strong justification to consider using something else is if you're developing for a platform that inherently has extremely limited memory.)
There is no need to panic if scrypt is being use correctly in certain projects. Encrypted data is safe if you used a strong password and a large enough iteration count. Encrypted data is also safe if you used a unique (single use) and unpredictable password, regardless of the iteration count.
But what's bad about scrypt?
- It has a single cost parameter. You cannot increase memory use without increasing run time.
- It's time-memory-trade-off allows a password cracker to decrease memory. Cutting memory by a factor of n only increases run time by a factor of n.
- It takes more time to fill memory than Argon2 (on existing x64 platforms).
- It would be easier to improve scrypt cracking hash rates using specialized hardware than it would be to improve on Argon2 hash rates.
So how do you use scrypt securely?
- Make sure to set the iteration count high. Try to use a few gigabytes of memory.
- Use randomly generated salts.
- Use a trustworthy implementation. Not just any GitHub project. Keep up to date with security updates.
- Design software such that you can increase parameters or migrate to a different hash algorithm.
The above four points are also applicable to using Argon2, but it's safer to use more or less time and/or memory. The advice for selecting parameters that accompanies version 1.3 of the PHC Argon project is good.