This seems to be the standard dupe target for "how do I hash passwords well" questions. It's a good dupe target, as they go; it's comprehensive, explains the reasoning behind the assertions, and finishes up with a few concrete recommendations.
The problem is that those concrete recommendations were made a little over six years ago, and a lot can change in six years, e.g. the introduction of Argon2, improvements in GPU cracking making bcrypt weaker than it used to be, . Given that it's still extremely highly voted and still used as a dupe target, I think it needs to be updated. There are a few ways we could do that:
- Leave it alone. As you can probably guess, this is my least favorite option. As well-written as that answer is, it's still six years out of date, and if it's left alone, it'll only get less and less accurate.
- Mark the old one as a dupe of a newer equivalent e.g. this. I don't like this approach, because I feel like people won't notice, or won't care about, the dupe notice -- they'll just scroll down to find their answer.
- Remove the recommendations from the top answer and let it just be what things to look for. I equally dislike this because, while it'd stay comparatively futureproof, it'd also just make people skip the big wall of "useless" text to find concrete recommendations.
- Create a new, canonical question to be maintained. This is a decent solution, but the current question has much more traction, and will show up at the top of the Google search results page for a long time.
- Update the answer regularly to reflect the state-of-the-art. I like this option the best because it keeps things as stable as possible, while still giving good, up-to-date information. The problem is that if we were inclined to do this, it'd already be happening, and I wouldn't be writing this question...
So what should be done?