note 92035 deleted from function.hash by danbrown

Note Submitter: DGM ---- In response to Leigh's note on Aug 6th 2008: >Just a quick note about these benchmarks and how you should apply them. > >If you are hashing passwords etc for security, speed is not your friend. You should use the >slowest method. > >Slow to hash means slow to crack and will hopefully make generating things like rainbow tables >more trouble than it's worth. While I can see why someone would make this suggestion, it could cause load issues with a web application that experiences a high peak period during which a lot of users are logging in. I would suggest heavily load testing any changes made to authentication as well as including a note about scalability in the application documentation, just so it does not come back to bite you.