4 ms·
Shouldn't effective brute forcing be prevented by the fact that this should be completely choking the server? I'm not completely sure what algorithms are curren
by noinsight 11y ago
Shouldn't effective brute forcing be prevented by the fact that this should be completely choking the server? I'm not completely sure what algorithms are currently used for password hashes in UNIX-likes but in any case, shouldn't this choke the server when it has to generate hashes for all those attempts at once (or consequently)? If you monitor loads at all this is very detectable. It's a good avenue for DDOS in that case though.
- tedunangst 11y agoHeh. I noticed a blistering two guess per second hacking attempt against my laptop because the fan went full jet engine.
- noinsight 11y agoSo on OpenBSD the hashes are bcrypt and rounds are based on system performance as per man crypt_checkpass? So it's like 15 bcrypt rounds on average hardware for ~500ms per hash? Linux seems to use a pathetic 5000 rounds of SHA-512: http://www.akkadia.org/drepper/SHA-crypt.txt http://www.akkadia.org/drepper/SHA-crypt.txt