4 ms·
You do the slow (bcrypt, argon2 or whatever) hash in the browser, and then the server can do the hyper-fast hash (SHA256). You can still flood the server, but
by pnako 7y ago
You do the slow (bcrypt, argon2 or whatever) hash in the browser, and then the server can do the hyper-fast hash (SHA256).
You can still flood the server, but you're flooding it with things that take microseconds to compute, instead of 50ms.
- tgb 7y agoThat's not what the article states, though it's not very explicit about why you shouldn't do what you suggest.