3 ms·
For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. There is no excuse not to do it, especially you need to do it only once
by llukas 8y ago
For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time.
There is no excuse not to do it, especially you need to do it only once per user (until password change).
- giancarlostoro 8y agoAs somebody else commented, a quicker solution is to just force a password reset based on number of months since last login. If you havent logged in for over a year is a good rule of thumb.
- overcast 8y agoRight, but I was replying to OP. "Twitter should probably scan their user passwords for obvious / most-used ones and require their users to change their passwords."
- kgermino 8y ago>For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. That's 90 hours per account, multiply that by 326 million accounts and it's over a billion CPU days. You can reduce it a lot (no need to spend time calculating the password for users who log in regularly, just wait for them to give it to you) but it's still a massive scale. Especially since the biggest risk comes from the millions of rarely used accounts.
- llukas 8y agoCorrect. Forgot to multiply by 10^6
- justsomedood 8y agoI'm getting 90 million hours of single threaded execution time for 326 million users with 10k passwords each, and 100ms per hash.