Re:Passwords for 32M Twitter accounts may have been hacked a...
by rmc on Thursday June 09, 2016 @12:50PM
(#11870585)
"a second to check a hash" is a long time, but that's 3,600 attempts per hour. With rate limiting you can bring that down to 10 attempts per hour.
[ Parent
| on HN ]
Re:Passwords for 32M Twitter accounts may have been hacked a...
by paulmd on Thursday June 09, 2016 @02:00PM
(#11871112)
Presumably your users don't want to wait 6 minutes to log in, and nor do you want to tie up a full core for 6 minutes running the hash. That's the problem with increasing bcrypt's work factor - you have to deal with the increased difficulty too.
If you're doing salting properly (a unique CSPRNG-generated salt for every user) then 3600 attempts per hour really isn't enough to get anything except the lowest of low-hanging fruit.