5 ms·

Ah derp. Totally forgot about rate limiting. Thank you.

• sintaxi 10y ago
  I thought bcrypt was a deliberately slow algorithm so it cant necessarily be brute forced.
  • WA 10y ago
    But still much faster than an HTTP request to an Auth API that allows only, say, 5 requests per minute.
  • Olscore 10y ago
    Right, but you would still bypass the rate limiting of the server whether that be login attempts, http requests per second, firewall rules, latency or whatever when checking.
    • dogma1138 10y ago
      That's another rate limiting that has nothing to do with the hash strength. Good password hashing functions have internal rate limits that reduce the likelihood of anyone being able to break the hashes easily because they will be expensive even when fully implemented in hardware. For how long are they resilient it's another question but bcrypt is pretty good, it's quite slow, and is expensive to implement in ASIC/FPGA.
      • sintaxi 10y ago
        This is what I was thinking about. Thanks.