3

This seems to be the standard dupe target for "how do I hash passwords well" questions. It's a good dupe target, as they go; it's comprehensive, explains the reasoning behind the assertions, and finishes up with a few concrete recommendations.

The problem is that those concrete recommendations were made a little over six years ago, and a lot can change in six years, e.g. the introduction of Argon2, improvements in GPU cracking making bcrypt weaker than it used to be, . Given that it's still extremely highly voted and still used as a dupe target, I think it needs to be updated. There are a few ways we could do that:

  • Leave it alone. As you can probably guess, this is my least favorite option. As well-written as that answer is, it's still six years out of date, and if it's left alone, it'll only get less and less accurate.
  • Mark the old one as a dupe of a newer equivalent e.g. this. I don't like this approach, because I feel like people won't notice, or won't care about, the dupe notice -- they'll just scroll down to find their answer.
  • Remove the recommendations from the top answer and let it just be what things to look for. I equally dislike this because, while it'd stay comparatively futureproof, it'd also just make people skip the big wall of "useless" text to find concrete recommendations.
  • Create a new, canonical question to be maintained. This is a decent solution, but the current question has much more traction, and will show up at the top of the Google search results page for a long time.
  • Update the answer regularly to reflect the state-of-the-art. I like this option the best because it keeps things as stable as possible, while still giving good, up-to-date information. The problem is that if we were inclined to do this, it'd already be happening, and I wouldn't be writing this question...

So what should be done?

3

I'd like to propose yet another option. Add some text (formatted as quote to stand out) to the top of the top voted answer, explaining the situation:

This answer was written in 2013. Since then, advances in password cracking has been made. It is now recommended to [bla bla bla bla].

  • Except, thats not really true - it's just more of the same. Everything in Thomas's answer is still correct, only thing that has changed is the PHC announced Argon2 as the "official" blessed algorithm. – AviD Jul 10 at 13:34
  • 1
    @AviD Don't know enough to say what should be in the note. But if we should do something I think a note at the top is the way to go. Making changes in the actual text of the question is a no starter for me, since it would ruin the prose of the Great Bear. – Anders Jul 10 at 14:29
1

My thoughts (TL/DR - go with 4. Or if not, then 2 or 5)

  • Leave it alone. I agree with you. It will become less useful
  • Mark the old one as a dupe of a newer equivalent - this works pretty well in general. It would be one of my preferred solutions
  • Remove the recommendations from the top answer - we could do this, but it can cause issues
  • Create a new, canonical question to be maintained. Google updates reasonably quickly based on updates to Stack Exchange so this would be my first choice
  • Update the answer regularly to reflect the state-of-the-art. This also works, and should be relatively easy, as long as people aren't too precious about their content. And it may mean we lose an answer that still has value in certain situations.
  • To be clear, my last point wasn't suggesting rewriting the entire thing, only the part where concrete (i.e. algorithm) recommendations are made, as new, strong algorithms are accepted and older, weakened ones are shifted away from. I think we're saying the same thing there, but I wanted to make it clear, just in case. – Nic Hartley Jul 6 at 0:08
  • 2
    Normally I would agree with you, however as this authoritative answer was written by [one of] THE authorities, namely @ThomasPornin, and in addition this answer would not need to be updated 3 times a year - I would lean towards #5, and simply ping Thomas to update it. – AviD Jul 7 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .