I'm thinking about my choices regarding how to store passwords in Postgres.
One such option is to use pgcrypto
. Reading their docs, I see that their crypt
and gen_salt
functions do not use sha256 but instead use custom version of the cryptographically broken md5
. Why would Postgres developers use such a hashing algorithm for their password storing module given that it's not secure?
I suppose I should use, instead of the broken (at least in my eyes) pgcrypto module, the built in binary function sha256
together with a random salt.