Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

Re:Opensubtitles.org breached – Email addresses, IP addresse... by colejohnson66 on Wednesday January 19, 2022 @09:18AM (#29993837)

The CPU usage difference between a hash on 20 bytes vs 100 (assuming ASCII) can't be that bad, can it?

[ Parent | on HN ]

Re:Opensubtitles.org breached – Email addresses, IP addresse... by patrakov on Thursday January 20, 2022 @05:46AM (#30007202)

We are not talking about 100 bytes of password here, but megabytes of garbage. See https://www.djangoproject.com/weblog/2013/sep/15/security/, also known as CVE-2013-1443.

"A password one megabyte in size, for example, will require roughly one minute of computation to check when using the PBKDF2 hasher."

[ Parent | on HN ]