4 ms·
Not normally, but it does open up a DoS vector that at the very least will prevent legitimate users from logging in.
by hackcasual 12y ago
Not normally, but it does open up a DoS vector that at the very least will prevent legitimate users from logging in.
- tptacek 12y agoIt's one of thousands of DoS vectors, all of which are addressed the same way: coarse ad-hoc anomaly filters.
- mox1 12y agoBut its a non-obvious (imo) attack vector opened simply by switching to scrypt / bcrypt. In a perfect world, quality web apps have rate limiting built into their auth schemes. But it's important to acknowledge these two algorithms will put a much heavier burden on your CPU.
- tptacek 12y agoMost DoS vectors are non-obvious, so this seems like a very weak reason to change the way you do password hashing.