MangaDex password storage disclosures

MangaDex

Rating B

PBKDF2 (disclosed December 2022)

Params: hash=SHA-256, iterations=310000

Disclosures:

Argon2 (disclosed December 2022)

Note: Used historically, existing password hashes will be converted to PBKDF2 on login.

Params: variant=Argon2id

Disclosures:

bcrypt (disclosed December 2022)

Note: Used historically, existing password hashes will be converted to PBKDF2 on login.

Disclosures:

A slow hashing function is used but such info is "invisible", hidden in a blog post or a talk, or on social media.

Recommended change: Publish storage and hashing info details visibly (e.g. in the docs or FAQ), then let me know.