from Hacker News

Using bcrypt to secure passwords in Perl

by geoffc on 7/11/11, 10:37 AM with 19 comments

• by LoonyPandora on 7/11/11, 11:46 AM

  I also blogged about this topic on blogs.perl.org the other week with some code examples that work a little better [1].

  Your code appears to work, but is subtly broken in a few ways. Firstly since you don't return the hash in the "standard" format ("$2a", "$", two digits, "$", salt as 22 base 64 digits, '.', and 31 base 64 digits for the pass), one can't tell what work factor was used to create the hash - making it hard to verify a password. Secondly the salt isn't sufficiently random, there are modules out there that provide more randomness for cryptographic applications such as this.

  It's nice to see people blogging about this kind of thing for perl, but it's important that the code is correct.

  [1] http://blogs.perl.org/users/james_aitken/2011/07/safely-stor...

• by draegtun on 7/11/11, 11:44 AM

  Also a very similar post Safely Storing Passwords from a few days earlier on blogs.perl.org which includes a Dancer bcrypt plugin: http://blogs.perl.org/users/james_aitken/2011/07/safely-stor...

• by jrockway on 7/11/11, 1:59 PM

  No, no, no. Just use Authen::Passphrase.

• by alfiejohn_ on 7/11/11, 12:27 PM

  It's a shame that the first comment was for a typo. Can't people get over these things?