Even salting is almost useless with the advent of GPU.
As the article mentions, using bcrypt or even scrypt (scrypt is designed to scale memory usage up as well), algorithms that can scale up in difficulty as hardware changes, should be standard or required for creating an application/site/whatever that stores a password hash.
But security is hard.
It'd be nice if something like OpenID became a defacto standard, or a standard set of libraries and implementations that developers would use at least.
__________________
Uncertainty is an uncomfortable position.
But certainty is an absurd one.
|