3 ms·
Because 50% of typical users will choose one of the top 10,000 most-common passwords and no practical amount of work factor will save them if the hashes become
by marshray 14y ago
Because 50% of typical users will choose one of the top 10,000 most-common passwords and no practical amount of work factor will save them if the hashes become known.
- lazyjones 14y agoConsequently, DB column permissions are also worth it because they hide the hashes, while such people are not protected at all by current hashing schemes. The Postgres function written to compare passwords/hashes can also limit the number of checks per time unit to prevent brute-forcing.