Skip to main content
3 of 5
Dude, don't openly admit that it is a matter of opinion. Just look at the snarky and hostile comments under your post to see that those hyaenas are looking out for any reason to close or delete your question. Don't give them fuel, your question is valid. Peace,

Is Password Hashing Bad?

In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: OpenID connect, "sign in with Google" or "Facebook", etc.

I am curious to understand more about these topics. I recently moved from a very large tech company to a much smaller one, and in my current company, they have a practice of storing user passwords in a database. They salt and hash the passwords, but I think that trying to manage security and cryptography themselves is biting off more than they can chew. In my research, I found this (source: Stanford University) and wondered if this community had any thoughts about the claims made here (this is a little dated..."Facebook" for example is mentioned, although I wondered if these recommendations are still relevant today).

For clarity, this is from a lecture entitled, "Bad (Attitude) Guide to Computer Security". So it is likely that the author is making these big claims with a kind of playfulness. I'm asking the question here to better understand the actual concepts and the seriousness of the claim (along the lines of, "is this a total joke that shouldn't be taken seriously at all, or is there actually a good lesson in this advice?")

lecture image

Daniel
  • 527
  • 1
  • 4
  • 13