36 ms·
Is that specifically to inconvenience someone who would break in, steal your password list, and crack it offline? If not, what was the design goal? If slowing
by wnight 15y ago
Is that specifically to inconvenience someone who would break in, steal your password list, and crack it offline?
If not, what was the design goal?
If slowing down web login attempts isn't part of it, why not get a dedicated auth server and offload the crypt stuff onto it?
And if it is the goal, you could use CPU-friendly sleeps on the front-end to give increasing delays to the repeated guesser.
- technomancy 15y ago> Is that specifically to inconvenience someone who would break in, steal your password list, and crack it offline? Probably: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ Hashing functions designed for speed are absolutely the wrong thing for passwords.
- wnight 15y agoYeah, that's what I'd have thought. But I don't see the need to do the processing on the web servers.