Hacker News new | ask | show | jobs
by tptacek 5102 days ago
Virtually no-one implements bcrypt themselves. If you use a bcrypt library, you don't need to think about salting. Therefore, when someone says "they're using individually salted passwords", you can usually count on the fact that they're using a crappy password hash, but that they think they're doing something cryptographically sophisticated.
1 comments

Not really related, but the popular python library for bcrypt kind of does make you have to think about salting. (And it has some other, er, 'curious' design decisions as well)

http://www.mindrot.org/projects/py-bcrypt/

So does popular ones for .NET, Java, JavaScript.. I haven't seen one where the work factor is explicitly set in the homepage example yet, though.