Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

22
  • 27
    To quote the linked comment: "[we] moved to PBKDF2 as it is built into the .NET framework, whereas BCrypt would require us to verify an implementation". Note that the comment doesn't say the algorithm is better, just that SE Dev Team considers the built-in PBKDF2 implementation more trusted than an external library (which is, ultimately, a judgement call). Commented Aug 9, 2011 at 9:07
  • 4
    @Piskvor I updated my answer. This isn't about what the SO team considers secure but a judgement call between inherently proven secure or hopefully secure. The latter when it comes to cryptography is unacceptable. Commented Aug 9, 2011 at 12:42
  • 8
    I wonder how SO migrated all the bcrypt hashed passwords to the new hashes? Wouldnt they need the raw passwords to hash it using the new algorithm? Commented Jan 6, 2014 at 22:44
  • 9
    @DK I don't even think you have to ask them to reset their passwords. On next log in (where they supply their plaintext password) you can do it I believe. Commented Jul 8, 2014 at 5:54
  • 13
    This is poor advice and I am surprised it has so many upvotes. Verifying a BCrypt implementation in a managed language is much, much more trivial than verifying something like an entire SSL implementation in C. Heartbleed is completely irrelevant; you'd be better off mentioning something like PHP type coercing problems with hash equality checks. Plus while largely suitable in a practical sense, PBKDF2 is a KDF, not a password hashing algorithm, whereas BCrypt is better suited. Regardless, it would make much more sense to use Argon2 these days anyway, for which there is a well-tested C# library Commented Jan 2, 2017 at 21:43