Skip to content
This repository has been archived by the owner on Sep 22, 2020. It is now read-only.

Verifying user passwords takes a significant amount of time because we use bcrypt #364

Open
jbuck opened this issue Jul 23, 2015 · 1 comment

Comments

@jbuck
Copy link
Member

jbuck commented Jul 23, 2015

Verifying user passwords and storing them in a secure fashion is important, which is why we use bcrypt. But because we use bcrypt, verifying passwords is really slow when you start to do more than 5 req/s with our current 2 dyno setup.

@jbuck
Copy link
Member Author

jbuck commented Jul 23, 2015

Options:

  • Throw more dynos at the problem
  • Change bcrypt work parameters
  • Use a faster bcrypt module (native lib with js bindings?)
  • Use a different algorithm that's still secure
  • Push bcrypt hashing somewhere else
    • On the client itself?
    • Onto a different service?
  • Talk to FxA people, copy whatever they did

@ashleygwilliams @cadecairos @simonwex @thisandagain anything else you can think of?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants