3 ms·
> it's just meant to show that you could do a select in one go without having to do them one at a time Which means you are performing 3 hashes, two of which ar
by adolph 5y ago
> it's just meant to show that you could do a select in one go without having to do them one at a time
Which means you are performing 3 hashes, two of which are likely unnecessary and sending all of them to sql for evaluation.
- dylan604 5y agoWhat's more costly, sending 3 separate queries or calculating 3 hashes? I honestly don't know.
- brigandish 5y agoYou have to calculate at least one hash and you only have to perform one query (as it can grab multiple hashes at once), and that query should not choose what to return based on the content of the hash(es). Pseudo code is supposed to strip away details that might distract from fundamentals, yet your pseudo code and subsequent replies suggest that your understanding is contrary to the actual fundamentals of checking a password securely. Start with limiting the set by choosing by user, never by hash. Jeremy Evans goes over many of the fundamentals[1], including why restriction of the selection is important, and why restriction of access to hashes (i.e. not sending them from the initial machine) are important. In his own framework (Rodauth) he doesn’t even allow selects of the hashes to be returned to app, let alone used as part of the where clause. Note the clause in each of the functions he defines (12:53 and 14:05). [1] https://www.youtube.com/watch?v=z3HZZHXXo3I https://www.youtube.com/watch?v=z3HZZHXXo3I