Password Hashing: bcrypt, scrypt, Argon2, and Getting It Right

Storing passwords looks like a solved problem -- pick a hash function and call it a day. The reality is that 'hash function' is the wrong word, the algorithm matters less than the parameters, and the choices you make today have to outlast a decade of attacker hardware improvements. Here's what actually matters.