3 ms·
Isn't the fact that s/bcrypt is by design costly preventing this idea from being executed?
by ernesth 14y ago
Isn't the fact that s/bcrypt is by design costly preventing this idea from being executed?
- tedunangst 14y agoAssuming you use 0.01s per hash settings, you can upgrade somewhere around a million accounts per hour.
- joshrice 14y agoSorta, but chances are you'll be generating way less then an attacker would need to do. More importantly, you owe it to your users to keep their passwords secure.
- deleted 14y ago[deleted]
- ww520 14y agoIt's unlikely that you have more users than the enumeration of the 128-bit key space (if MD5 was used). The slowness of bcrypt prevents the brute force attack through the key space for EACH user. That's N x 2^128 for N users, whereas to upgrade, you only have to do it N times.