News for hackers. Stuff that matters.

A comment on Passwords for 32M Twitter accounts may have been hacked and leaked. Parent comment

Re:Passwords for 32M Twitter accounts may have been hacked a... by xerophyte12932 on Thursday June 09, 2016 @04:19AM (#11868186)
wouldn't the slowness of bcrpyt be a hindrance enough? Of course rate limiting is a much greater barrier, but I thought the whole point of using bcrypt is that its naturally slow and prevents checking several passwords in a short time
[ Parent | on HN ]
Re:Passwords for 32M Twitter accounts may have been hacked a... by TACIXAT on Thursday June 09, 2016 @08:52AM (#11869000)
You can set the work factor (log rounds). Bcrypt is also cool because it doesn't scale well to GPUs, so it's still pretty slow even if you have decent hardware.

The rounds are a trade off between how long your users will wait to login and how strong the hashes will be. The current recommendation is between 8 and 12 depending where you look. The best practice is to just check on the system you are running, I usually aim for the number of rounds nearest a half a second.

[ Parent | on HN ]