<turbo-stream action="append" target="posts_list"><template>    <div class="postbit" id="115651" data-post-id="115651">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="riverrun" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/riverrun/120/7244_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  riverrun
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Version 5 has been released.</p>
<p>This version is an update based on <a href="https://github.com/riverrun/comeonin/issues/130" rel="noopener nofollow ugc">this issue</a>. Comeonin now provides two behaviours, Comeonin and Comeonin.PasswordHash, which can then be implemented by password hashing libraries.</p>
<p>Together with this update, argon2_elixir and bcrypt_elixir have been updated to version 2.0, and pbkdf2_elixir has been updated to version 1.0.</p>
<p>To update to the new versions, remove <code>:comeonin</code> from the deps function in your mix.exs file, update the hashing library to the latest version, and then edit the hashing functions as shown below:</p>
<p>Comeonin.Argon2.add_hash → Argon2.add_hash<br>
Comeonin.Argon2.check_pass → Argon2.check_pass<br>
Comeonin.Argon2.hashpwsalt → Argon2.hash_pwd_salt<br>
Comeonin.Argon2.checkpw → Argon2.verify_pass<br>
Comeonin.Argon2.dummy_checkpw → Argon2.no_user_verify</p>
<p>For more information see <a href="https://github.com/riverrun/comeonin/blob/master/UPGRADE_v5.md" rel="noopener nofollow ugc">this guide</a>.</p>
<p>If you have any questions / comments, please let me know.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="115651" data-batch-url="/posts/batch_likers">
                        6
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/comeonin-password-hashing-library/2732/22">Post #21</a>
	                </div>
	            </div>
              <div id="likers-container-115651" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="115651"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #21"></div>
  </section>
</div>
    <div class="postbit" id="153920" data-post-id="153920">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="egeersoz" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/egeersoz/120/15704_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  egeersoz
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>So which hashing algorithm is recommended for systems being designed today?</p>
<p>I’ve read some opinions stating that Argon2 might be better. For instance:</p>
<aside class="onebox stackexchange" data-onebox-src="https://security.stackexchange.com/questions/193351/in-2018-what-is-the-recommended-hash-to-store-passwords-bcrypt-scrypt-argon2">
  <header class="source">

      <a href="https://security.stackexchange.com/questions/193351/in-2018-what-is-the-recommended-hash-to-store-passwords-bcrypt-scrypt-argon2" target="_blank" rel="noopener nofollow ugc">security.stackexchange.com</a>
  </header>

  <article class="onebox-body">
      <a href="https://security.stackexchange.com/users/90896/jcaron" target="_blank" rel="noopener nofollow ugc">
    <img alt="jcaron" src="https://i.sstatic.net/k1R45.jpg?s=256" class="thumbnail onebox-avatar" width="256" height="256">
  </a>

<h4>
  <a href="https://security.stackexchange.com/questions/193351/in-2018-what-is-the-recommended-hash-to-store-passwords-bcrypt-scrypt-argon2" target="_blank" rel="noopener nofollow ugc">In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?</a>
</h4>

<div class="tags">
  <strong>passwords, hash, bcrypt, scrypt</strong>
</div>

<div class="date">
  asked by
  
  <a href="https://security.stackexchange.com/users/90896/jcaron" target="_blank" rel="noopener nofollow ugc">
    jcaron
  </a>
  on <a href="https://security.stackexchange.com/questions/193351/in-2018-what-is-the-recommended-hash-to-store-passwords-bcrypt-scrypt-argon2" target="_blank" rel="noopener nofollow ugc">12:59AM - 10 Sep 18 UTC</a>
</div>

  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>

<p>…but I figured I’d ask the Elixir community as well.</p>
<p>In what scenarios would Argon2 should actually be preferred over Bcrypt? The link posted above says “…and offline cracking is in the threat model.” In this context, does “offline cracking” mean the attacker somehow grabs a copy of your database and can attempt to crack the password hashes in it?</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="153920" data-batch-url="/posts/batch_likers">
                        0
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/comeonin-password-hashing-library/2732/23">Post #22</a>
	                </div>
	            </div>
              <div id="likers-container-153920" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="153920"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #22"></div>
  </section>
</div>
    <div class="postbit" id="153921" data-post-id="153921">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="danschultzer" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/danschultzer/120/4942_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  danschultzer
                  </h3>
		          </div>
						
			          <div class="user-title">
									<span>Pow Core Team</span>
			          </div>
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Yeah, Argon2id is the best option atm. At least, SCrypt is better than BCrypt. In the vast majority of cases it doesn’t really matter since there are much easier ways to get passwords than cracking them.</p>
<p>I wrote about it in the <a href="https://hexdocs.pm/pow/1.0.15/production_checklist.html#optional-use-an-appropriate-password-hash-method" rel="noopener nofollow ugc">production checklist</a> for Pow with a link to this <a href="https://medium.com/@mpreziuso/password-hashing-pbkdf2-scrypt-bcrypt-and-argon2-e25aaf41598e" rel="noopener nofollow ugc">medium post</a> that details the different popular password hashing options.</p>
<p>Argon2 <a href="https://password-hashing.net" rel="noopener nofollow ugc">won the Password Hashing Competition in 2015</a>.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="153921" data-batch-url="/posts/batch_likers">
                        2
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/comeonin-password-hashing-library/2732/24">Post #23</a>
	                </div>
	            </div>
              <div id="likers-container-153921" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="153921"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-last-post cat-last-post" title="Last post!"></div>
  </section>
</div>
</template></turbo-stream><turbo-stream action="replace" target="load-more-container"><template><div id="load-more-container" class="load-more-container">
    <span class="all-loaded">— All posts loaded —</span>
</div></template></turbo-stream>