5 ms·
Could you design a system where the hard work happens on the client side? For ex, the server sends the client a secret encrypted with the bcrypt hash.. and the
by cookingrobot 15y ago
Could you design a system where the hard work happens on the client side? For ex, the server sends the client a secret encrypted with the bcrypt hash.. and then the client machine spends a couple seconds working on it and sends back the response. It might allow for a huge work factor without impacting the server.
- mynegation 15y agoNo, you couldn't. Nothing prevents malicious client from "letting itself in", no matter whether password was correct or not.