Hacker News Reader

That's a bad idea, because it implies that your password hash has to be expressible inside of Postgres.

If you're worried about a SQL dump exposing password hashes, segregate password validation into its own microservice. This comes with other benefits: for instance, you can ratchet up the work factor on your password hash, because the service will very easily scale horizontally.

View on HN

First of all, this pattern is not exclusive to password hashes. There are lots of situation when handling customer data where you simply don't need the ability for the client to query the whole data-set, and if that's the case, allowing it is just bad hygiene.

Now if you make a good set of prepared statements as an interface for your database, this could be viewed as a "micro service" in it self.

Yes, and that's a good pattern. Just not for password hashes.

Reply on news.ycombinator.com