Hacker News Reader

Sorry I should have rephrased that, I really meant "isn't using any kind of salt at all deprecated"? Honest... :-)

http://codahale.com/how-to-safely-store-a-password/

[Edit: I meant your typical web application mucking about with salts, not their use within properly thought out things like bcrypt]

View on HN

I believe the standard library for bcrypt in ruby also uses salts, it just stores the salt with the hashed password data.

Salts will prevent the typical rainbow table attack where you have precomputed hashes for a large number of attempts. Salts won't prevent brute force, but bcrypt will make it so that brute force takes too long for a single given user.

Bcrypt uses salts. But your link is correct, attempting to roll your own crypto is getting all these companies caught out and bad crypto use is causing their users to suffer. I for one would now not feel safe using a password for more than one website.

Reply on news.ycombinator.com