Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This article is right for the case of using HMACs for two parties checking the authenticity of a message passed between them (assuming they have a shared secret).

But it's wrong about the database password storage. These days the real threat there is the monstrous computing power available to compute tons of hashes simultaneously. To combat that, you want a hashing function specifically designed to be slow. And not just slow, but to have a tunable parameter so you can require more and more work as GPUs get faster and cheaper. PBKDF2 is such a function, and is used by Django as of a year or two ago. bcrypt is another.



This. Use bcrypt or scrypt for storing secrets. HMAC is for...hash(ing) message authentication code(s); read: http://security.stackexchange.com/questions/16809/is-a-hmac-...




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: