Hacker News new | ask | show | jobs
by thirsteh 4706 days ago
You shouldn't be using any of the functions on that page directly, anyway: http://throwingfire.com/storing-passwords-securely/#notpassw...
1 comments

But it does matter, because if you can exploit a weakness in the hash function you can figure out the salt, strip it, and then use your precomputed dictionary.
That's not really how it works. Either way, you shouldn't be using just a regular "hash function" anyway. Even basic constructions like PBKDF2 use HMAC constructions where SHA1 and even MD5 are still pretty safe to use (although not very computationally expensive.)