antirez/lamernews — comment on commit d23a38b0afb9ab767e5a462517ccc2166769dc91
File: app.rb line 642
By antirez:

I agree with you about simplicity, but since we had that long discussion about password hashing done right at this point I tried to do things the right way, using a nist-approved primitive (sha1), a well analyzed algorithm like PBKDF2, and setting a minimum password length.
Also using PBKDF2 I was able to depend only on pure-ruby ruby-hmac, openssl is used only if available to speedup. More than number of dependencies I'm concerned with installation problems.

Btw the hashing is not a big problem for the understanding of the system as it is into a separated file, while the user salt adds complexity to the user object. But after all... this is also instructive for the reader, since without all this stuff it is not possible to write a decent auth system. So I implemented per user salt in the latest commit.