Salt or no, if you’re using a general-purpose hash function designed for speed you’re well and truly effed.

bcrypt Solves These Problems

How? Basically, it’s slow as hell.

An interesting topic I’ve been studying recently: how to build a secure password storage system. This is an important component of that, i.e. use slow algorithms.

Here is a hint. If you want to see more jobs created by Small Businesses and entrepreneurs REDUCE the amount of paperwork required. Dramatically simplify the tax code. In other words, if you REDUCE THE OVERHEAD of small business, you effectively create capital for them through reduced costs. Not only do you improve their financial position, but you reduce that great big time suck known as dealing with your accountants and lawyers. The more time wasted with “professional services”, the less time spent doing your job. This seems to be a concept lost on government.

Makes sense to me. Clearly it won’t be attempted.

If you list all your friends, and then ask them all how many friends they have, their ­average is very likely to be higher than your friend count. The reason is bewilderingly ­simple: “You are more likely to be friends with someone who has more friends than with someone who has fewer friends,” as the ­psychologist Satoshi Kanazawa puts it. You’re more likely to know more popular people, and less likely to know less popular ones. Some people may be completely friendless, but you’re not friends with any of them.

Neat.

Mike was unhappy. He had hired a huge company of IT consultants to build The System. The IT consultants he hired were incompetents who kept talking about “The Methodology” and who spent millions of dollars and had failed to produce a single thing.

Luckily, Mike found a youthful programmer who was really smart and talented. The youthful programmer built his whole system in one day for $20 and pizza. Mike was overjoyed. He recommended the youthful programmer to all his friends.

Youthful Programmer starts raking in the money. Soon, he has more work than he can handle, so he hires a bunch of people to help him. The good people want too many stock options, so he decides to hire even younger programmers right out of college and “train them” with a 6 week course.

The trouble is that the “training” doesn’t really produce consistent results, so Youthful Programmer starts creating rules and procedures that are meant to make more consistent results. Over the years, the rule book grows and grows. Soon it’s a six-volume manual called The Methodology.

After a few dozen years, Youthful Programmer is now a Huge Incompetent IT Consultant with a capital-M-methodology and a lot of people who blindly obey the Methodology, even when it doesn’t seem to be working, because they have no bloody idea whatsoever what else to do, and they’re not really talented programmers — they’re just well-meaning Poli Sci majors who attended the six-week course.

And Newly Huge Incompetent IT Consultant starts messing up. Their customers are unhappy. And another upstart talented programmer comes and takes away all their business, and the cycle begins anew.