Don't use bcrypt

Hi, I'm Tony Arcieri. You may remember me from such software projects as Celluloid, Reia, and Cool.io... If you're already using bcrypt, relax, you're fine, probably. However, if you're looking for a key derivation function (or in bcrypt's case, password encryption function) for a new project, bcrypt is probably not the best one you can pick. In fact, there are two algorithms which are each better

[masakielastic2]

有名なセキュリティの研究者(moxie 807)によれば、ところどころの説明に間違いあり。https://news.ycombinator.com/item?id=3724560

[kazuhooku]

パスワード暗号化手法による解読コストの比較 (salted MD5, PBKDF2, scrypt, bcrypt)

[t-wada]

まだしばらくは安全だけれども、 "JUST USE BCRYPT" は思考停止につながるので、 bcrypt に安住しちゃダメだよという話

[tmatsuu]

喫緊の問題というわけではないが、bcryptよりもPBKDF2やscryptの方がいいですよ、これから導入するなら後者２つを採用しましょうという話。scryptって初耳かも。メモ