3 ms·
You only have to generate the hash during login, not during every page request. I don't think the majority of the time on most websites are spent on logging in.
by FooBarWidget 17y ago
You only have to generate the hash during login, not during every page request. I don't think the majority of the time on most websites are spent on logging in.
- tptacek 17y agoYou're right, but (I know I'm repeating myself) you don't even have to concede that for bcrypt to be a win. You can make hashes take sub-user-visible time and still make dictionary attacks totally infeasible. SHA1 is extremely fast. Even "just not extremely fast" is a win.