News for hackers. Stuff that matters.
Re:Twitter urges users to change passwords after computer 'g... by Jach on Thursday May 03, 2018 @05:12PM (#16990028)
From the password compromise side, not really, you're just pushing the cost of hashing to your users (and it will impact mobile users more). There's a similar technique on needing proof-of-work on the client to combat DDoS.

From the authorization side, there is a threat, because if your table storing hashes is compromised, attackers just have to supply the stored hash to the auth endpoint and they get to login as anyone.

A combination of hashing on the client side (or immediately once the pw hits the endpoint) with something cheaper followed by a more intense bcrypt/scrypt afterwards might help a bit with the tradeoffs.

There are no comments on this comment yet.