>For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. That's 90 hours per account, multiply that by 326 million accounts and

>For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. That's 90 hours per account, multiply that by 326 million accounts and it's over a billion CPU days. You can reduce it a lot (no need to spend time calculating the password for users who log in regularly, just wait for them to give it to you) but it's still a massive scale. Especially since the biggest risk comes from the millions of rarely used accounts.