Answered Recommended Password Hash Algorithm for Evo 1.0.12

Hello,

I am just wondering what the recommended / suggested Password Hash Algorithm for Evo 1.0.12 is (in Tools > Conguration > User)?

The options are:

• CRYPT_BLOWFISH_Y (salt & stretch)
• CRYPT_BLOWFISH_A (salt & stretch)
• CRYPT_SHA512 (salt & stretch)
• CRYPT_SHA256 (salt & stretch)
• CRYPT_MD5 (salt & stretch)
• UNCRYPT(32 chars salt + SHA-1 hash)

My site is currently set to UNCRYPT(32 chars salt + SHA-1 hash) - which appears to be the default.

Thanks in advance.

Ok, thanks Mr Haw. I appreciate the reply.
I think I will run with that also.
In searching, Blowfish sounds like an older style of security but still very solid.
Many thanks.

That Android atricle was interesting - a lot of it was over my head but good to know if I get an Android phone. And those apps sounds great.

Imagine you accidentally let a browser save your password:
http://www.engadget.com/2013/08/07/chrome-saved-passwords/

OpenSSH and PuTTY uses Blowfish...
https://www.schneier.com/blowfish-products.html
EDIT ---> Correction: OpenSSH uses others chipers as well
http://www.openssh.com/txt/gcmrekey.adv

But everything above md5 is a win. [ed. note: mrhaw last edited this post 12 years, 10 months ago.]

Thanks mrhaw.