It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?


You could, in addition to using a slow hash function, limit the number of requests per second a particular user could send. For instance, if you're getting 30 failed login requests from a particular IP address, then you could delay the responses to that address, or drop them all together.

Slowing hash functions is designed to make it impractical to carry out a brute force attack if an attacker gets access to the password database. There should still be precautions built into the server as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.