Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not sure what advice to give you. You commonly see advice to outsource your security, to other libraries, the idea being these are more likely to be correct than you. However, there have been some pretty high profile mistakes in common crypto libraries too! If there's anything specific you have in mind, I'd be happy to field questions (and hopefully other HN users will correct me in the event I'm wrong!)


Cheers (that's why I love this place).

At the moment I use Authlogic in Rails, which uses SHA512 by default (SHA512 is built into the Ruby core libs).

But I also notice that it's quite easy to switch to bcrypt (using the bcrypt gem).

Is it worth switching? Or at least using that as my default on new apps?


What is it being used for, and how is it being used? I'm guessing this is password hashes. Is rails using a unique salt for each password?

Bcrypt is slower than SHA512, in fact it can be made to be very slow. This is actually ideal for password hashes, it doesn't matter if it takes your server 50 milliseconds to calculate a password hash but that would severely slow down an attack.

It is important however that they are being used correctly. Either would be a good solution if properly salted.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: