4 ms·
The time bcrypt takes is configurable, so in the future you can adjust the amount of work per password -- this is literally a one-character change in your code
by pjscott 14y ago
The time bcrypt takes is configurable, so in the future you can adjust the amount of work per password -- this is literally a one-character change in your code -- and be alright again. Ditto for the rest of the decent password hashing schemes.
- raverbashing 14y agoTrue, but you can't really bet on that Sure, you can increase the work, but you'll still be limited by bcrypt size Otherwise, you could just MD5 hash stuff X times and be done with it Sure, bcrypt today is very safe, but I wouldn't be surprised if attacks are found today (even if they rely only on bruteforce) And let's not forget implementation issues that may happen in specific bcrypt libraries