Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

Re: Password shtuff

by tye (Cardinal)
on Dec 31, 2010 at 00:12 UTC ( #879881=note: print w/ replies, xml ) Need Help??


in reply to Password shtuff

Testing on one of our web servers showed current crypt takes about 8us while MD5 crypt takes about 1ms, which is over 100x as much CPU (and we'd need better enforcement on the cap on password length but with a limit much higher than 7; a 200-char password takes about 3ms). But my proposal was to not even include the full non-salt encrypted password in the cookie, just the last $n characters, say 20 16 of the 22. Then we aren't even calling crypt on every page hit (just when somebody changes their password). And somebody sniffing your cookie doesn't mean they can dictionary attack and find your password.

Corion and I have each worked on new "password reset e-mail" implementations.

- tye        


Comment on Re: Password shtuff

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://879881]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others examining the Monastery: (13)
As of 2014-07-10 21:57 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    When choosing user names for websites, I prefer to use:








    Results (217 votes), past polls