Hacker News new | ask | show | jobs
by Pesthuf 744 days ago
I thought it was obvious since I mentioned bcrypt and argon 2 later that I meant plain, simple, single round SHA-256. Usually salted, but there's one database where they're not, for some weird MySQL view compatibility hack that allows reusing the accounts and password hashes in a different legacy application that doesn't support salts whatsoever.

The reasons why this is terrible for storing password hashes are widely known, everyone else in the comments is already talking about how you're meant to use something like PBKDF2 or bcrypt instead, so I didn't see the need to put an explanation nobody needs in my comment.