3 ms·

This is 400 _registrations_ per second not logins. On the test hardware, Passport can handle 1,000 logins per second. Remember that the server this test was run

This is 400 _registrations_ per second not logins. On the test hardware, Passport can handle 1,000 logins per second. Remember that the server this test was run on is 10 years old and has crap hardware. Running these tests on a modern box with new Xeon CPUs and a 2400MHz bus would probably double or triple those numbers.

nickpsecurity 10y ago
Ah, yeah I test on old hardware for efficiency too. One thing Im trying to assess is how registration might be accelerated. What operations are involved in a registration request that arent a trade secret or something?
- brokenwren 10y ago
  During registration, you need to handle things like assigning roles to the user for your application, verifying the users email, setting up two-factor authentication (if they want) and storing metrics. The metrics are helpful for tracking registrations and correlating them to things like marketing campaigns.
  - nickpsecurity 10y ago
    Ok, so it's not sounding so bad at this point. Plenty of acceleration opportunities for such things.
yxhuvud 10y ago
Scenario: Servers has to be restarted (or crash) during rush hour with 100M active users. Even being generous and allowing for 10000 logins per second, it will take almost 3 hours for everyone to relogin. Oops. Ok, so that 100M is clearly not viable for services that actually expect a significant amount of their users to use the service at roughly the same time (that is - it would clearly not handle Facebook amount of load). A much more relevant metric would be how many simultaneous sessions you can handle while being able to claim good service (say, the 99th percentile being able to login without getting time-outs). Also, generally speaking, most authentication systems will involve at least a few server-side writes for logins, meaning the difference to new registrations shouldn't be all that big in a well designed and compartmentalized system. Disclaimer: Yeah, I used to work for a company that did authentication servers for ISPs.
- nickpsecurity 10y ago
  There we go. That a good example of the kind of issue I was talking aboug. A much more realistic one, too. Of course, we're talking about registration rather than just authentication. Their authentication numbers are probably much higher and such are easy to HW accelerate.

nickpsecurity 10y ago

Ah, yeah I test on old hardware for efficiency too. One thing Im trying to assess is how registration might be accelerated. What operations are involved in a registration request that arent a trade secret or something?

brokenwren 10y ago
During registration, you need to handle things like assigning roles to the user for your application, verifying the users email, setting up two-factor authentication (if they want) and storing metrics. The metrics are helpful for tracking registrations and correlating them to things like marketing campaigns.
- nickpsecurity 10y ago
  Ok, so it's not sounding so bad at this point. Plenty of acceleration opportunities for such things.

yxhuvud 10y ago

Scenario: Servers has to be restarted (or crash) during rush hour with 100M active users. Even being generous and allowing for 10000 logins per second, it will take almost 3 hours for everyone to relogin. Oops. Ok, so that 100M is clearly not viable for services that actually expect a significant amount of their users to use the service at roughly the same time (that is - it would clearly not handle Facebook amount of load). A much more relevant metric would be how many simultaneous sessions you can handle while being able to claim good service (say, the 99th percentile being able to login without getting time-outs). Also, generally speaking, most authentication systems will involve at least a few server-side writes for logins, meaning the difference to new registrations shouldn't be all that big in a well designed and compartmentalized system. Disclaimer: Yeah, I used to work for a company that did authentication servers for ISPs.

nickpsecurity 10y ago
There we go. That a good example of the kind of issue I was talking aboug. A much more realistic one, too. Of course, we're talking about registration rather than just authentication. Their authentication numbers are probably much higher and such are easy to HW accelerate.