3 ms·
The usual way to do this is to treat the bloom filter as a cache that can have false positives. So instead of querying haveibeenpwned for each attempted passwo
by andrewla 8y ago
The usual way to do this is to treat the bloom filter as a cache that can have false positives. So instead of querying haveibeenpwned for each attempted password from the user, you only query if the bloom filter says that the password was found. If the bloom filter says that the password was not found, then that means it is definitively not found in the upstream.
- w8rbt 8y agoExactly. More people should read the original Bloom Filter paper. It covers this. Bloom (1970): "In application areas where error-free performance is a necessity, these new methods are not applicable." (p. 422) https://dl.acm.org/citation.cfm?doid=362686.362692 https://dl.acm.org/citation.cfm?doid=362686.362692