4 ms·
This line of reasoning is only valid if rate-limiting is in place. If the database gets breached for example then the attacker can do a lot more iterations, ev
by zimbatm 8y ago
This line of reasoning is only valid if rate-limiting is in place.
If the database gets breached for example then the attacker can do a lot more iterations, even if the password hash are salted.
- sjwright 8y agoYou can thwart or mitigate most brute force attacks with key stretching. Even if you only require 50 msec of work per password on current hardware, you have made the prospect of a brute force exponentially more difficult. If the database gets breached with write access, a user's password can be bypassed entirely, even if it can never be discovered. If the database contains all of the information the hacker wants to know, they don't need to hack your account, they can just read the tables directly.