15 ms·
No. You take the compromised plaintext password, hash it using the same algorithm you typically do for your customers, then you check the hash for matches in yo
by everfree 4y ago
No. You take the compromised plaintext password, hash it using the same algorithm you typically do for your customers, then you check the hash for matches in your database of existing customer password hashes.
- yjftsjthsd-h 4y agoShouldn't salting make that expensive?
- vbitz 4y agoNot if your only checking 1 possibility rather than a few million. It could take on the order of a few seconds per password in the worst case. Normally a few Milliseconds. So 1,000,000 breached passwords * 100ms per check is 100,000 CPU seconds or about 30 CPU hours to check all passwords. The is easily paraliseable so imagine more like 10-20 minutes in parallel.
- Thorrez 4y ago>So 1,000,000 breached passwords * 100ms per check is 100,000 CPU seconds or about 30 CPU hours to check all passwords. For a single user's account. Multiply that by 1 million ring users and you get 30 million CPU hours.