3 ms·
Why wait until 3 tries? Why not just require 1 second between all attempts?
by jjnoakes 10y ago
Why wait until 3 tries? Why not just require 1 second between all attempts?
- blauditore 10y agoHmm, I guess this makes sense. Not sure what I was thinking...
- viggity 10y agoif you're hashing with PBKDF2 and 100k+ iterations, it can take that long anyway.
- tedunangst 10y agoBut not in parallel.
- sleavey 10y agoCan hashing iterations be conducted in parallel? Doesn't the next hash need the output of the last, making this a sequential operation?
- niftich 10y agoBoth of you are correct, just talking about different things. PBKDF2 rounds are clearly sequential. Meanwhile, you can issue multiple simultaneous requests in parallel to try to authenticate the credentials, possibly from a large bank of distinct hosts.