News for hackers. Stuff that matters.
Re:Passwords for 32M Twitter accounts may have been hacked a... by rmc on Thursday June 09, 2016 @12:50PM (#11870585)
"a second to check a hash" is a long time, but that's 3,600 attempts per hour. With rate limiting you can bring that down to 10 attempts per hour.
Re:Passwords for 32M Twitter accounts may have been hacked a... by paulmd on Thursday June 09, 2016 @02:00PM (#11871112)
Presumably your users don't want to wait 6 minutes to log in, and nor do you want to tie up a full core for 6 minutes running the hash. That's the problem with increasing bcrypt's work factor - you have to deal with the increased difficulty too.

If you're doing salting properly (a unique CSPRNG-generated salt for every user) then 3600 attempts per hour really isn't enough to get anything except the lowest of low-hanging fruit.