Re: [go-nuts] built-in alternative to bcrypt?

2019-04-22 Thread Sam Whited
On Mon, Apr 22, 2019, at 10:14, whitehexagon via golang-nuts wrote: > I am concerned about the Go binary size, since I'm already at 15MB! So > I'm trying to limit external dependencies as much as possible. Staying in the standard library won't help you here. You'll still have to link in the code y

Re: [go-nuts] built-in alternative to bcrypt?

2019-04-22 Thread Aldrin Leal
Hashing passwords without salt are prone to rainbow table attacks. I particularly like this comment in a Java Source Code: https://github.com/apache/shiro/blob/f782eb1084df73eff3e2ac0f9780cb4a4f429041/core/src/main/java/org/apache/shiro/authc/credential/HashedCredentialsMatcher.java#L56 When stor

[go-nuts] built-in alternative to bcrypt?

2019-04-22 Thread whitehexagon via golang-nuts
I'm porting some code over to Go, and currently looking at some password hashing. I'm wondering if there is a 'standard library' alternative to using bcrypt? I am concerned about the Go binary size, since I'm already at 15MB! So I'm trying to limit external dependencies as much as possible.