in reply to Re: Adjust bcrypt cost to prevent future password hash attacks
in thread Adjust bcrypt cost to prevent future password hash attacks
The OP is using salted hashes and also assumes that LinkedIn was doing the same. The use of cost here would be to prevent many attacks per second against the hashes since an attack would take additional time. The hope is that this time is long enough to deter attackers who already have the ability to see your salted hashes, or have the ability to query the login server repeatedly. TLS has the ability to filter out login requests over the network, and this addition of bcrypt will help against physical attacks where data has already been compromised.
|
|---|