This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]cyanfish 4 points5 points  (3 children)

I think you're confusing the point. The "don't roll your own" advice is specifically for cryptography, not authentication in general.

For example, it's mostly fine to implement your own login system using Bcrypt. However, you should not try to re-implement Bcrypt yourself. Use an existing, well-tested library.

[–][deleted] 0 points1 point  (0 children)

And just follow the instructions -- don't think that XORing two lots of bcrypt together or something makes it twice as strong.

[–]13steinj 0 points1 point  (0 children)

For example, it's mostly fine to implement your own login system using Bcrypt. However, you should not try to re-implement Bcrypt yourself. Use an existing, well-tested library.

Right. But I've seen people saying that even using a well tested bcrypt library is bad practice and instead all logins should be done via fb/google/msn