Comment by zaroth | Hacker News Reader

Comment by zaroth | Hacker News Reader

Parent Full thread

I am the author of the article. Thanks for pointing out scrypt, I have heard of it before. PBKDF2, bcrypt, scrypt... they all share one thing in common:

They MUST be configured to run fast enough on your server so that your users can login even under high system load.

Let's say you need to support being able to test 1,000 passwords per second on your server (to support your projected peak login traffic). In that case, relatively weak passwords can be cracked, and by relatively weak I mean 95th percentile entropy bits for less than $1,000 on EC2.

This is why I'm trying to think differently about the problem. If we hide the hash in a haystack, the attacker will no longer be able to target an individual user, and theft of the entire hash database should be more easily detectable and preventable.

_Nobody_ is hashing thousands of passwords per second as part of a typical webapp load. Even if somebody was, they would need only ~50 cores for hashing. I'm sure anybody with that much traffic could easily shell out a few thousand bucks for the extra processors without blinking.

Also, an 8 character password hashed with scrypt with a very low (64ms) cost takes on average $4.8 million to brute force[1].

1: http://www.tarsnap.com/scrypt/scrypt.pdf

Thanks for citing your source! You rock.

They are claiming 6.57 * 8 = 52.5 bits of entropy would cost $4.8m to crack a single password in a year.

They also state 4.7 * 8 = 37.6 bits of entropy would cost $150 to crack a single password in a year.

Their own citation of 'A large scale study of web password habbits' http://research.microsoft.com/pubs/74164/www2007.pdf found that the average password has only 40.5 bits of entropy. I'm afraid even scrypt will not save you from 40 bit entropy passwords.

The point is that nothing will "save" a single user for whom there is a dedicated attacker. But you can make it uneconomical to attack the whole database. That's what bcrypt, scrypt et al do.

Reply on news.ycombinator.com