Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"

Re: Password shtuff

by tye (Sage)
on Dec 31, 2010 at 00:12 UTC ( #879881=note: print w/replies, xml ) Need Help??

in reply to Password shtuff

Testing on one of our web servers showed current crypt takes about 8us while MD5 crypt takes about 1ms, which is over 100x as much CPU (and we'd need better enforcement on the cap on password length but with a limit much higher than 7; a 200-char password takes about 3ms). But my proposal was to not even include the full non-salt encrypted password in the cookie, just the last $n characters, say 20 16 of the 22. Then we aren't even calling crypt on every page hit (just when somebody changes their password). And somebody sniffing your cookie doesn't mean they can dictionary attack and find your password.

Corion and I have each worked on new "password reset e-mail" implementations.

- tye        

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://879881]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (6)
As of 2018-03-17 07:20 GMT
Find Nodes?
    Voting Booth?
    When I think of a mole I think of:

    Results (223 votes). Check out past polls.