News for hackers. Stuff that matters.

A comment on Authentication Cheat Sheet. Parent comment

Re:Authentication Cheat Sheet by simi_ on Monday February 02, 2015 @02:55PM (#8986480)
At Lavaboom, we simply check against the 10k most used passwords (in memory), but we plan to move to 1 million soon (on disk – account creation is relatively infrequent for the slower access speed to not matter).

Our problem is that we SHA the passwords on the client side, so each password is 256 bits long. The resulting hashtable (or bloom filter) is still a reasonable size for disk storage, though.

[ Parent | on HN ]
Re:Authentication Cheat Sheet by jamiesonbecker on Monday February 02, 2015 @11:05PM (#8988800)
We SHA256 the passwords on the client side at Userify (SSH key management for EC2) as well (bcrypt is too slow in mobile browsers), and then bcrypt on the server side the resultant hash. (We don't cache it, though.)

Even in the event of a TLS leakage, we still never see your original password, and the server doesn't end up doing any more work. It's not perfect, but I definitely agree it's a great step forward.

[ Parent | on HN ]
Re:Authentication Cheat Sheet by simi_ on Wednesday February 04, 2015 @09:45AM (#8997021)
That's exactly what we do, too, except we've bravely switched to scrypt at some point.
[ Parent | on HN ]
Re:Authentication Cheat Sheet by ddlatham on Monday February 02, 2015 @06:46PM (#8987924)
With a bloom filter that's still just 2MB of memory for a 99.99% accuracy.
[ Parent | on HN ]