Skip to content

Update and rename bcryptpasswords.md to passwordhashing.md#775

Merged
goldbergyoni merged 11 commits into
goldbergyoni:masterfrom
josh-hemphill:master
Oct 31, 2020
Merged

Update and rename bcryptpasswords.md to passwordhashing.md#775
goldbergyoni merged 11 commits into
goldbergyoni:masterfrom
josh-hemphill:master

Conversation

@josh-hemphill

@josh-hemphill josh-hemphill commented Oct 7, 2020

Copy link
Copy Markdown
Collaborator

closes #325
Presenting the tradeoffs between the IETF's and OWASP's top recommendations, as well as adding mention of making your implementation unique to make your hash different from other's if given the same password.
Mentioned to use IETF's default parameters for the functions.

I thought about saying more about Salt generation, but it was already getting a bit verbose. So any suggestions would be helpful.

I should also mention, the linked issue's original point doesn't apply to the actual bcrypt npm module (removed suggesting "other" bcrypt modules), but the discussion deviated into more generally providing the situationality of the top recommended algorithms.

Presenting the tradeoffs between the IETF's and OWASP's top recommendations, as well as adding mention of making your implementation unique.
@js-kyle

js-kyle commented Oct 8, 2020

Copy link
Copy Markdown
Contributor

This looks great! Someone or myself will be able to review it when we can 👍

js-kyle
js-kyle previously approved these changes Oct 18, 2020
Comment thread sections/security/passwordhashing.md Outdated
Comment thread sections/security/passwordhashing.md Outdated
Comment thread sections/security/passwordhashing.md Outdated
Comment thread sections/security/passwordhashing.md Outdated
Comment thread sections/security/passwordhashing.md Outdated
@js-kyle

js-kyle commented Oct 18, 2020

Copy link
Copy Markdown
Contributor

This looks good to me. If you have some time @lirantal could you take a second look, since you were across some of the earlier discussion for this practice?

Co-authored-by: Kyle Martin <kyle.martin@hotmail.co.nz>
josh-hemphill and others added 4 commits October 18, 2020 13:41
Co-authored-by: Kyle Martin <kyle.martin@hotmail.co.nz>
Co-authored-by: Kyle Martin <kyle.martin@hotmail.co.nz>
Co-authored-by: Kyle Martin <kyle.martin@hotmail.co.nz>
@goldbergyoni goldbergyoni self-requested a review October 20, 2020 08:11

@goldbergyoni goldbergyoni left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@josh-hemphill Welcome aboard, this is truly an amazing drill-down💜

@js-kyle @josh-hemphill One fundamental suggestion - The new version not only makes this much more exhaustive and advanced but also might make it harder for the average developer to extract actionable items. I would choose the 2-3 core messages including the action item (e.g. use Bcrypt or Script, whatever you think). This shouldn't be longer than 2 paragraphs, we call it "One paragraph" but we're developers and start counting from zero :) Anyway, it should be shorter and simpler than what we have now.

Then all the great advanced content and elaboration should come at the bottom under a title 'Advanced and references'.

Resonates with you?

Comment thread README.md Outdated
Comment thread sections/security/userpasswords.md Outdated
@lirantal

Copy link
Copy Markdown
Contributor

FYI @js-kyle @goldbergyoni added some comments above

js-kyle
js-kyle previously approved these changes Oct 24, 2020
goldbergyoni
goldbergyoni previously approved these changes Oct 29, 2020

@goldbergyoni goldbergyoni left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@josh-hemphill Looks more than perfect to me, amazing work 💜. I believe that this will help 80% of the developers to avoid fatal mistakes and allow the 20% to understand much better and make thoughtful decisions. Consider changing the title, make it more tangible and punchy, see my comment.

This will get merged in 24 hours. Obviously adding you now to the contributor's board, Tweeting about it and putting in the news. What's your Twitter handle?

@js-kyle Great coordination and review

@lirantal You're the king

@josh-hemphill josh-hemphill dismissed stale reviews from goldbergyoni and js-kyle via 7bbda49 October 29, 2020 20:35
@goldbergyoni goldbergyoni self-requested a review October 31, 2020 16:37

@goldbergyoni goldbergyoni left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@goldbergyoni goldbergyoni merged commit 38d8874 into goldbergyoni:master Oct 31, 2020
@goldbergyoni

Copy link
Copy Markdown
Owner

@all-contributors please add @josh-hemphill for content

@allcontributors

Copy link
Copy Markdown
Contributor

@goldbergyoni

I've put up a pull request to add @josh-hemphill! 🎉

elite0226 pushed a commit to elite0226/nodebestpractices that referenced this pull request Oct 31, 2022
Update and rename bcryptpasswords.md to passwordhashing.md
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6.8 Feasibility of time-based database brute-force attacks on websites

4 participants