Hacker News Reader

I don't understand it still. The cost factor and the string remains the same but different hashes are produced. So if a user inputs "hi,mom" and the app generates a hash, how is it going to be the same as the one in DB ?

Or did you make a mistake and the cost factors are supposed to different ?

View on HN

Just do what the library tells you to do to check passwords and trust me that bcrypt hashes already have nonces built into them.

I had the same question; I don't know the answer yet, but I found a location for the answer http://www.openbsd.org/papers/bcrypt-paper.ps

The documentation for py-bcrypt ( http://www.mindrot.org/projects/py-bcrypt/) doesn't explain what happens, but shows use is very very easy.

EDIT: current guess is that searching for the salt that was used might be part of what makes it hard.

Reply on news.ycombinator.com