1

It is a known good practice to use slow password hashing algorithms with a tunable iteration count to increase the difficult of a successful bruteforce attack on a password hash.

I quote part of an answer by Thomas Pornin on Information Security Stackexchange.

As much as possible ! This salted-and-slow hashing is an arms race between the attacker and the defender. You use many iterations to make the hashing of a password harder for everybody. To improve security, you should set that number as high as you can tolerate on your server, given the tasks that your server must otherwise fulfill. Higher is better.

A high iteration count for the password hashing function will lead to a slight delay when a user is attempting to register or login. Are there studies that show how long a user is willing to wait before thinking that something is wrong?

Improve this question
3
  • Interesting question, though I doubt the delay would be noticeable with today's processors. If the delay was noticeable by a human and the processor was spinning that whole time chewing on a hashing algorithm, I'd be more worried about upgrading the hardware to handle the load than I would be about delaying the user a few more milliseconds. Ironically, that upgrade would speed it up. I have seen some sites (even the Linux desktop login) enforce a time delay, aside from actual computation time, to prevent brute-force.
    – Matt
    Oct 18, 2013 at 4:32
  • @Matt The point about using algorithms with variable iteration count is the ability to tune the count higher if I have better hardware to make it more difficult for an attacker. Ideally, I would like to find an acceptable time, say 1 second and tune the iteration count to hit that goal even with better hardware, hence the question. :)
    – Ayrx
    Oct 18, 2013 at 4:39
  • The delay is more relevant over high-latency connections, such as mobile (rather than because of lots of hashing iterations). I think there's a presentation from LinkedIn somewhere talking about how they speed up sign in (they assume your details are correct, and start loading instantly -- everything gets reverted if the sign in fails).
    – Brendon
    Oct 18, 2013 at 6:29

1 Answer 1

Reset to default
1

Here's an interesting infographic relating to your question.

Its not specifically about logging in times and I suspect if users already have an account they'll be prepared to wait longer for a site than if it was their first visit, however it does show that with every passing millisecond users will drop from your site/app so its important to optimise loading times as much as possible.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.