vorticity Wrote:@TvT Rivals: You didn't post the salt along with the hash. I am curious why you didn't choose one of the stock solutions today like bcrypt or scrypt. The bcrypt algorithm is designed to be configurably slow so the cracking difficulty level can be increased along with Moore's Law. The scrypt approach is similar, but it also uses a lot of memory so that one cannot simply parallelize into Mordor.
1. Oh, it was totally deliberate that we didn't post the salt. The idea was: We'll post the salt in several chunks. Today you get the first one: "7VtdN1Wl".
2. Thank you very much for suggesting scrypt. We'll definitely implement this instead of our old solution. While we're at it, we'll also update the database (that is, the user table) in a way that it'll allow further security improvements. Just in case someone invents an even safer algorithm (hard to imagine, though).
Yeah, security is pretty important to us.