Bad Practice or Full Transparency?

Would you consider it bad practice for a website that allows user registration to explain how passwords are hashed in the security section of the FAQs?


In a debate with a friend who says, "Only password managers ever tell you what algorithm they use to hash your password. I've never once noticed it on any other type of website and it would be Hollywood to do this."


Is there anything wrong with outright stating that the site uses argon2id (or …

bad cybersecurity practice transparency