undefined | Better HN

0 pointstempnow9874y ago0 comments

Rate limit the requests. Do an account lockout with an email click to re-enable after 10 guesses, do 2FA on new devices and you get pretty good security.

For many systems, users can memorize 6 digits easily.

The reality is, whatever your password reset flow is is enough. If you can reset your password with a 6 digit number via text, then that is maximum needed for actual password as well in most cases.

0 comments

marcosdumay4y ago

None of that will help you if your hash database leaks. But I'm ok with letting the decision with the user.

tempnow987OP4y ago

Interesting. In most cases if hash database leaks, the ability to crack depends on two factors, not one (password and hash difficulty) assuming you are salting properly.

You can specify pretty high difficulty with argon2id etc. Ie, shoot for a one second runtime with a very high memory requirement (you can go to GB range even).

So I'm not sure all is always necessarily lost

j / k navigate · click thread line to collapse