Reply to thread

Message: <blockquote data-quote="Ecko" data-source="post: 261058" data-attributes="member: 24874">There is nothing wrong with using bcrypt (which PHP 5.5 does with the password_hash() function). bcrypt is 10,000x slower than sha1 and as long as you do not use a fixed salt you will be fine (it's actually better to let the salt be generated by random noise from the OS). Even if processors get stronger, bcrypt has a cost parameter to internally hash the password x amount of times. As far as using Facebook/Twitter's API, that's fine but you should also keep in mind they are prime targets for potential hackers. Relying on a secondary source to maintain the security of your application is not very smart.</blockquote>