5 ms·
You use email+password for login. Does this mean that on every login attempt, you iterate through every row in the database to check for a hash match?
by raziel2p 6y ago
You use email+password for login. Does this mean that on every login attempt, you iterate through every row in the database to check for a hash match?
- q3k 6y agoI mean, how's that different from 'iterating' over every row in search of an email address? Indexes solve that.
- deleted 6y ago[deleted]
- kle 6y agoYes, exactly as you would do to check for an email address match.
- akmittal 6y agohash the email first and then check for same hash in db.
- wtetzner 6y agoBut don't you need to know which salt to use?
- wccrawford 6y agoI think the others are missing the fact that if you use the same salt for every row, it's less secure. So you'll be storing the email more securely, but still not as securely as you should be storing the password. To do it any more securely would require pulling up every single record for its salt, and hashing the login with that salt and checking it. It's virtually impossible at any real scale.
- raziel2p 6y agoHah, when I wrote my comment above I didn't even consider the possibility of using the same salt everywhere. I suppose the goal here is privacy, not information security, so it's okay.
- benlivengood 6y agoIt's pretty scalable. 10 billion email addresses times 16+32+4 bytes of salt, SHA512/256, and ID is 520GB of RAM; available in a single (big) machine and searchable in under a second with a few cores. Shard it into multiple machines for higher QPS.