Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121129
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.600.7\))
In-Reply-To: <CAOWwgp=cJWtF8GS6h9Aq42bwJXTwbkG1L1LpcS7HLqK0hrj5rQ@mail.gmail.com>
Date: Fri, 22 Sep 2023 09:46:08 +0100
Cc: =?utf-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>,
 PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <44945ACB-066E-4805-8EF2-26796BA01671@craigfrancis.co.uk>
References: <a9b0d24f-fe59-75af-4b1e-dcd8067482b0@bastelstu.be>
 <CAOWwgp=cJWtF8GS6h9Aq42bwJXTwbkG1L1LpcS7HLqK0hrj5rQ@mail.gmail.com>
To: Nicolas Grekas <nicolas.grekas+php@gmail.com>
Subject: Re: [PHP-DEV] [VOTE] Increasing the default BCrypt cost
From: craig@craigfrancis.co.uk (Craig Francis)

On 22 Sep 2023, at 08:04, Nicolas Grekas <nicolas.grekas+php@gmail.com> =
wrote:
> For the record, I voted for 11 because I think it's nicer to end users =
(I guess many don't know they could have a potential DoS vector via =
password submissions), and also because it's going to be easy to raise =
again in 8.5/9.0.


+1

I can't vote, but I would urge people to be careful with this.

While a high cost might make you *feel* good, the DoS problem is real, =
especially on older hardware - 10 is still fine today, 11 is a fair =
improvement against brute force guessing, 12 is just burning CPU cycles =
today, simply because the difference does not address the problem of =
commonly used passwords (like 123456, password1, monkey, etc).

Also, if you want to increase the cost yourself, on a system which =
blocks too many password attempts, you can do that easily - this is =
about the default, for people who are not customising it for their =
(shared/old) hardware.

Craig,
OWASP Bristol chapter leader, and regular attendee of PasswordsCon.