No hashlists 4 u!
5
posts
Has nothing to do with the hash.
Failed password attempts are rejected immediately.
The purpose of a hash is to obsfucate the password in the database in the event of a breach.
There is no encryption mechanism for transport over HTTP so there is no decryption at the other end, nor is there any decryption when looking up the password against the database. (that would slow things down. if you want a fast TEA transport encryption layer ported to javascript and php, ask me, I've got one. Ported it myself.)
It is a one way fast hash, which then checks the password sent and recently encrypted against stored encrypted values.
It is the initialization routine which is probably slow.
Now lets talk about something serious and open source software. All the apache mods for throttle protection lose compatibility every few years. It's as if it is done on purpose to squeeze out non profitable extensions, forcing website developers and IT managers to pay exhorbitant prices for upstream and cloud layer services.
5
posts