3 ms·
But its a non-obvious (imo) attack vector opened simply by switching to scrypt / bcrypt. In a perfect world, quality web apps have rate limiting built into the
by mox1 12y ago
But its a non-obvious (imo) attack vector opened simply by switching to scrypt / bcrypt.
In a perfect world, quality web apps have rate limiting built into their auth schemes. But it's important to acknowledge these two algorithms will put a much heavier burden on your CPU.
- tptacek 12y agoMost DoS vectors are non-obvious, so this seems like a very weak reason to change the way you do password hashing.