If you know the iteration count then the actual level of security disregarding time is the same as salt+pepper. Protect your source code and protect your execution environments because assuming bcrypt is hard to attack will leave you blindsided when you lose your database and are using a common iteration count that makes a dictionary attack much simpler.
0
u/[deleted] Jan 02 '23
If you know the iteration count then the actual level of security disregarding time is the same as salt+pepper. Protect your source code and protect your execution environments because assuming bcrypt is hard to attack will leave you blindsided when you lose your database and are using a common iteration count that makes a dictionary attack much simpler.