5 ms·
If the number of salts used in the system is equal to the number of users, this could be expensive.
by wizardishungry 14y ago
If the number of salts used in the system is equal to the number of users, this could be expensive.
- jarito 14y agoThey will just check your password against a list of 'bad' passwords when you log in. No need to brute force the stored hash.
- wizardishungry 14y agoObviously that would work, but not if you're using Challenge-response authentication. In general, I don't think people bother with now that when using https.
- wizardishungry 14y agoA little bit of googling makes it seem like auth tokens are not sent it plaintext over HTTPS but are authenticated using challenge response – http://forums.dropbox.com/topic.php?id=47952 http://forums.dropbox.com/topic.php?id=47952 The WWW site may differ.
- tedunangst 14y agoAssuming they use straight up salted sha256, my five year old core2 laptop does at least 10,000 per second, per core. They could check every user for the top 10k passwords for a few hundred bucks of EC2 time.
- xentronium 14y agoWhy do you assume that?