derbyparty/derby-login — pull request #6 by kylefinley (2014-09-07 23:51:25+00:00)
Title: Switched from SHA-1 + salt to bcrypt w/ salt for password hashes.

I'm not sure if you are interested in making this changes. There are some trade offs.

Pros:
- In the event of a database compromise: bcyrpt, as a slow hashing algorithm, provides added security.
- Increasing the cost factor will make it possible to keeping up with hardware advancements.

Cons:
- Existing password hashes will need to be updated when users login again. The code to do this was not included.
- Slow, although the Cost factor is configurable, you might prefer to check passwords quickly.

Please feel free to reject this pull request if it doesn't meet your goals.

Thanks,

Kyle