Beefy Boxes and Bandwidth Generously Provided by pair Networks
XP is just a number

Re: Password shtuff

by tye (Sage)
on Dec 31, 2010 at 00:12 UTC ( #879881=note: print w/ replies, xml ) Need Help??

in reply to Password shtuff

Testing on one of our web servers showed current crypt takes about 8us while MD5 crypt takes about 1ms, which is over 100x as much CPU (and we'd need better enforcement on the cap on password length but with a limit much higher than 7; a 200-char password takes about 3ms). But my proposal was to not even include the full non-salt encrypted password in the cookie, just the last $n characters, say 20 16 of the 22. Then we aren't even calling crypt on every page hit (just when somebody changes their password). And somebody sniffing your cookie doesn't mean they can dictionary attack and find your password.

Corion and I have each worked on new "password reset e-mail" implementations.

- tye        

Comment on Re: Password shtuff

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://879881]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others wandering the Monastery: (8)
As of 2015-11-27 09:58 GMT
Find Nodes?
    Voting Booth?

    What would be the most significant thing to happen if a rope (or wire) tied the Earth and the Moon together?

    Results (722 votes), past polls