Hacker News new | ask | show | jobs
by chilicuil 3268 days ago
You shouldn't use hash functions designed for integrity, they're fast, fast is bad for password hashing, a single AMD graphics card can compute 200M guesses per second for single sha-512 iterations, instead use bcrypt, scrypr or any other hash function specifically designed for key stretching.

https://hashcat.net/hashcat/

https://en.m.wikipedia.org/wiki/Key_stretching

1 comments

Yep, I'm using pbkdf2-hmac-sha256 which is not just sha-256. The 2nd link you posted mentions pbkdf2.