3 ms·
In last.fm's defense, they argued that there were some hardware devices (radios) that had last.fm clients, so they couldn't update their password system. I hav
by ludwigvan 14y ago
In last.fm's defense, they argued that there were some hardware devices (radios) that had last.fm clients, so they couldn't update their password system.
I have a question though, how would a strong password that takes around 1 second to hash affect the scalability of these systems; would it impact the login times of users a lot? Imagine thousands of people trying to login at once. Might it be the reason linkedin didn't hash and salt properly?
- tosh 14y agoThey still could've STORED them in a different way in the backend (e.g. use the md5 hash as 'password' and then use pbkdf2) then the leak would not have been as much of a problem as it was.
- Jebus 14y agoIt doesn't have to be 1 second. Just use something that was designed to store passwords, so it at least it isn't blazing fast, and it gives semantic security, like bcrypt does (you don't even need to think about salts). Also, having a configurable amount of rounds gives some degree of security through obscurity, so the attacker also needs access to the code, or lose time figuring the correct amount of rounds. I think most attackers would just desist. Sha-X, md5, etc, where designed to be fast. You don't want slow checksums.