serby/control — pull request #99 by mjor (2012-07-26 11:39:15+00:00)
Title: Use bcrypt to hash administrator passwords

I set the default work factor to 9, which runs in 0.045 seconds on my machine, roughly 420 times faster than crypto/sha1. This seems like a sane default for most sites.

bcrypt also stores both the work factor and the random salt it generates in the created hash itself, so there's no need to store those separately.