The Slower the Stronger: A Story of Password Hash Migration
summary
A case study of migrating Ocado’s password store: benchmarks show 19–20 billion MD5 hashes/sec per GPU, while bcrypt cost=8 ≈80 ms on their machines, so PBKDF2 (chosen) is used with Bouncy Castle via a password-hasher with hash vector API. The migration builds background jobs to translate existing hashes to vectors, append PBKDF2, and finally cleanup; it runs on an isolated worker node, handles orphan rows by cloning the table for rollback, takes many months in practice, and completes successfully.
AI-written summary · about
chapters (24)
- 0:00Start
- 2:04Agenda
- 5:28Slow hashing algorithms
- 7:39Argon2
- 8:36PBKDF-2
- 11:36bcrypt hash
- 13:52Hashing speed comparison-live demo
- 16:15How long does it take to compute a hash?
- 18:11Migration process
- 18:36What Ocado Technology does
- 21:18Why change?
- 25:11Example hashVector
- 26:59PasswordHasher API
- 29:53Migration plan
- 32:36Migrate passwords when customers provide them
- 33:45Translate current passwords to hashVectors
- 35:45After full migration is done
- 36:14Migration report
- 37:10Problems
- 37:23Problem: time taken to migrate
- 39:08Problem: orphan password entries
- 43:06Summary (we're almost there!)
- 44:53Links
- 45:21Thank you for listening!
related talks
36mThe Slower the Stronger: A Story of Password Hash Migration
42mPassword Hashing
27mKeeping passwords safe in 2017
31m680,000 Plaintext Passwords: An Open Source Love Story in Three Acts
25m80,000 Plaintext Passwords: An Open Source Love Story in Three Acts
34m80,00 Plaintext Passwords
29m80,000 Plaintext Passwords: An Open Source Love Story in 3 Acts
43mPlease pass the salt: Serve up passwords with a side of entropy