3 ms·
The primary problem here would be a DoS attack against a web server that accepted that much data in a submission form. edit: also, merely saying "bcrypt" isn't
by thaumaturgy 13y ago
The primary problem here would be a DoS attack against a web server that accepted that much data in a submission form.
edit: also, merely saying "bcrypt" isn't quite sufficient; we'd have to know what work factor you were testing with. bcrypt with a work factor of 2 is vastly different in performance from bcrypt with a work factor of 12.
- nknighthb 13y ago> we'd have to know what work factor you were testing with Parentheses are not made to be ignored. But I don't think it matters, which is why it was a parenthetical. The point is the relative differences between different sized strings, not the absolute timings.
- thaumaturgy 13y agoWhoops, sorry -- dunno how I missed that.
- Spittie 13y agoIsn't the password length check done locally on the machine (with javascript or similar)? If so, an attacker could easily ignore that check and send as much data as he want. The check on that should (and, AFAIK, is) done server-side, with the server closing the connection after a certain amount of data or time.