Hacker News Reader

A few MB is acceptable for https POST these days. This gets hashed down to 64 chars or whatever.

Are you aware of that secure pw hashing comes with a cost factor and that the cost is linear with the size of the input to the hashing algorithm?

EDIT: Down voters. What pw hashing algo are you using instead of BCrypt or similair?

I'm not particularly familiar with this stuff, but aren't the cost factors for hash algorithms essentially the number of times to nest the hash function? i.e. `hash(hash(hash(hash(hash(input)))))` type of thing. So it would cost more, but only for the first round? After that the size is reduced to the size of the image of the hash for future rounds?

That said, a few MB is a lot for one client to post if you have a significant amount of traffic. Just hash client side first.

Reply on news.ycombinator.com