Beefy Boxes and Bandwidth Generously Provided by pair Networks
Your skill will accomplish
what the force of many cannot

Re: Password shtuff

by tye (Sage)
on Dec 31, 2010 at 00:12 UTC ( #879881=note: print w/replies, xml ) Need Help??

in reply to Password shtuff

Testing on one of our web servers showed current crypt takes about 8us while MD5 crypt takes about 1ms, which is over 100x as much CPU (and we'd need better enforcement on the cap on password length but with a limit much higher than 7; a 200-char password takes about 3ms). But my proposal was to not even include the full non-salt encrypted password in the cookie, just the last $n characters, say 20 16 of the 22. Then we aren't even calling crypt on every page hit (just when somebody changes their password). And somebody sniffing your cookie doesn't mean they can dictionary attack and find your password.

Corion and I have each worked on new "password reset e-mail" implementations.

- tye        

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://879881]
[Corion]: I think I saw virtualsue more recently in person than online :-D
[virtualsue]: It's true that there was a bigger gap between the 2 yr old post and the one before it
[ambrus]: yes, I probably just didn't see you two years ago, because I'm not in perlmonks much
[virtualsue]: Nor am I :-)
[talexb]: virtualsue Heh .. long time no see! :)
[virtualsue]: I have a quiet Perl themed slack workspace
[virtualsue]: The person who talks to me on it the most *hates* Perl but she hates everything

How do I use this? | Other CB clients
Other Users?
Others musing on the Monastery: (11)
As of 2017-09-26 13:54 GMT
Find Nodes?
    Voting Booth?
    During the recent solar eclipse, I:

    Results (295 votes). Check out past polls.