The Slower the Stronger: A Story of Password Hash Migration

on YouTube ↗36m

" summary

Shows a concrete password-hash migration: old bcrypt cost 8 takes ~80 ms, raising to cost 12 stays under ~500 ms on their servers; a GPU benchmark cited can do ~119 billion MD5s/sec, so slow hashes matter. Builds an internal password hasher library that emits a hash vector (md5→bcrypt→PBKDF2 with configured iterations), a background translator job and a separate migration node off the load balancer, plus a cloned table for orphaned entries and a daily progress endpoint; migration runs ~1 year and succeeds.

AI-written summary · about

" chapters (7)

1. 0:00Introduction and motivation
2. 1:11What are slow hashing algorithms
3. 10:52Live demo of hash algorithms
4. 15:36Case study introduction
5. 24:34Migration plan and API
6. 30:20Problems and solutions during migration
7. 34:59Summary and recommendations

" related talks

• 51mThe Slower the Stronger: A Story of Password Hash MigrationTomasz Borowiec · GeeCON 2019
• 42mPassword HashingEmil Bayes · JavaScript fwdays'17
• 27mKeeping passwords safe in 2017Emil Bay · JSConf EU 2017
• 31m680,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck Fluffmuffin · ArrrrCamp 2014
• 25m80,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck · Cascadia Ruby 2014
• 29m80,000 Plaintext Passwords: An Open Source Love Story in 3 ActsT.J. Schuck · Red Dot Ruby Conference 2014
• 34m80,00 Plaintext PasswordsT.J. Schuck · Rocky Mountain Ruby 2014
• 43mPlease pass the salt: Serve up passwords with a side of entropyBrad Wood · Jfokus 2026