Comments (4)
tjconcept
commented on July 26, 2024
Hi @JuliusHaring that is, to some extent, the very idea of this package. The more time your machine spends hashing the password, the harder it is to crack.
You can tweak the time by adjusting the work parameter. For instance setting it to 0.5 should cut the time in half. 3-4 seconds does seem like a long time.
from credential.
ericelliott
commented on July 26, 2024
DO NOT adjust the work parameter. You will destroy your app's security. Instead, move your login service to a separate server that is not responsible for serving non-login related requests.
from credential.
ericelliott
commented on July 26, 2024
Even better, forget storing passwords for your own app, and offload authentication & password management to a dedicated, security-aware third party service such as Auth0. See "Passwordless Authentication with Auth0".
from credential.
ericelliott
commented on July 26, 2024
3-4 seconds is a long time, but if your server is underpowered (it is), adjusting the work parameter is still a very bad idea, because the bad guys have REALLY FAST computers and networks of cracking computers powered by parallel-processing GPU clusters.
from credential.
Related Issues (20)
- I can't make the cli work HOT 8
- Verifying with a pre-parsed JSON object HOT 4
- What if an attacker know that I am using this library? HOT 9
- The use of "time" - a weakness worth noting? HOT 13
- Why hash() just return string rather than object? HOT 2
- fix failing CI server
- Does it really needs webpack? HOT 7
- Node v6 deprecation - "crypto.pbkdf2 without specifying a digest is deprecated" HOT 3
- Release v2.0.0 on npm HOT 3
- Support bcrypt hashing method? HOT 1
- Make errors programmatically processable HOT 7
- Do not encourage people to write security issue in public places HOT 1
- Default number of iterations seems extreme HOT 2
- Due to the large number of iterations, Its consuming the full CPU usage. HOT 7
- Update deps, freshen code, release new major version. HOT 7
- Bad default settings HOT 4
- the 'verify' function takes too much time, about 1.3 seconds HOT 2
- Inconsistent use of bytes length/encodings? HOT 3
- Hash and Verify taking too much time HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from credential.