Hacker News new | ask | show | jobs
by danneu 3340 days ago
You'd want to distribute the load of your slow password-hashing functions across your application servers rather than centralizing it in your single database.
2 comments

Postgres bcrypt is wicked fast. You need some crazy load before it makes sense to move hashing out of the DB.
If your PW hashing function is wicked fast, you need to increase the work factor. The whole idea of a paw hash is to be comparatively slow, because that's one property that makes it harder to crack. Otherwise we could all go back to salted md5
Please change to a higher factor. PostgreSQL's default is a bit outdated and too low for modern computers.
You can have more than on database node as well.