password_lock

Their solution is very similar to the mode prescribed by [1] and implemented in [2]. There are actually two problems with bcrypt: - It truncates after 72 characters - It truncates after a NUL byte If anyone is dead set on following Dropbox's example, make sure you aren't passing raw binary to bcrypt. You're playing with fire. Additionally, if you're going to use AES-256, don't implement it yourself. Use a well tested library that either uses AEAD or an Encrypt then MAC construction. [1]: https://paragonie.com/blog/2016/02/how-safely-store-password... [2]: https://github.com/paragonie/password_lock

Anybody who runs unverified code, through any medium, when the option to run trusted code is available, deserves to get pwned. https://github.com/paragonie/password_lock/blob/master/run-t... ^- For the record, I keep scripts like this in my Git repositories.