2024-02-29 15:36:57 +01:00
|
|
|
==== Use specific password hashing algorithms
|
|
|
|
|
|
2024-03-01 09:57:51 +01:00
|
|
|
In general, rely on an algorithm with no known weaknesses, and rule out the
|
|
|
|
|
others, such as MD5 or SHA-1.
|
2024-02-29 15:36:57 +01:00
|
|
|
|
|
|
|
|
While considered strong for some use cases, some algorithms, like SHA-family
|
|
|
|
|
functions, are too fast to compute and therefore susceptible to brute force
|
2024-03-01 09:57:51 +01:00
|
|
|
attacks, especially with attack-dedicated hardware. +
|
|
|
|
|
Modern, slow, password-hashing algorithms such as *bcrypt*, *PBKDF2* or *argon2*
|
|
|
|
|
are recommended.
|
2024-02-29 15:36:57 +01:00
|
|
|
|
