4 ms·
"a second to check a hash" is a long time, but that's 3,600 attempts per hour. With rate limiting you can bring that down to 10 attempts per hour.
by rmc 10y ago
"a second to check a hash" is a long time, but that's 3,600 attempts per hour. With rate limiting you can bring that down to 10 attempts per hour.
- paulmd 10y agoPresumably your users don't want to wait 6 minutes to log in, and nor do you want to tie up a full core for 6 minutes running the hash. That's the problem with increasing bcrypt's work factor - you have to deal with the increased difficulty too. If you're doing salting properly (a unique CSPRNG-generated salt for every user) then 3600 attempts per hour really isn't enough to get anything except the lowest of low-hanging fruit.