Please, please, share the long answer! (or one of them, at least...) I would think that using bcrypt for authentication would not only consume more server CPU

Please, please, share the long answer! (or one of them, at least...) I would think that using bcrypt for authentication would not only consume more server CPU power, but would also open the door to denial-of-service attacks (if crackers attempted brute-force attacks on the log-in system). Clearly "use bcrypt" is just part of the answer... I had some thoughts on a way to deal with this: http://news.ycombinator.com/item?id=2705915 http://news.ycombinator.com/item?id=2705915 (but my ideas have their own set of problems.)