On: Salted Password Hashing – Doing It Right

[tptacek]

Plenty of applications built on MySQL use bcrypt. For example: see virtually every Rails app.

[atoponce → tptacek]

CREATE USER 'tptacek'@'db.example.com' IDENTIFIED BY 'su3rl337P@$sw0rd';

Let me know when MySQL supports bcrypt/scrypt.

[tedunangst → atoponce]

I don't see how this is even relevant. What do MySQL's limitations have to do with your decision to store a password hash? Are you writing your entire application in MySQL?

[ghshephard → tedunangst]

I'm curious - is that a common practice with backend applications - writing only with MySql application code and not using anything else like Java/PHP/Python/C# etc?

I know Oracle has pretty sophisticated stored procedures, but even so, most of the application logic of systems I've seen had program code written in an "external" language.

[tptacek → ghshephard]

In 10 years of consulting with a large team for companies big and small I saw a total of none applications built this way.

[tptacek → atoponce]

See comment downthread about "competence".