Re:Auditor's response to "Our security auditor is an idiot" ...
by reitzensteinm on Friday July 29, 2011 @07:58AM
(#2821302)
It's a storage versus computation time trade off, and with something like bcrypt doing the hashing, hashing 1-10k passwords will be too slow to provide real time feedback as a user is changing their password. On the other hand, storing even 10k hashes per employee per month of employment just isn't that much storage.
[ Parent
| on HN ]
There are no comments on this comment yet.