Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 1
    I know you're seeing a performance difference but the point of that hash is to be slow - so it's an odd overall complaint to make. Commented May 7, 2024 at 8:36
  • Of course it is, but with that poor performance - 1.5 secs instead of 0.5 - I could make only so few iterations, that the security wouldn't be too high before impacting UX. Commented May 7, 2024 at 8:37
  • This is one time that "poor performance" is a good thing! If it's only 0.5 seconds in .NET 8 I would be tempted to up the iteration count. This is one part of your application that it pays to pe slow. I think 2 seconds should probably be the target here. How often would a user actually experience this on your site? Commented May 7, 2024 at 9:18
  • 1
    Correct me if I am wrong, but: Hashing Passwords is supposed to secure the passwords in case the database got compromised. So if the attacker has the password hashes he doesn't have to use the slow implementation of PBKDF2 in .NET 4.8 to bruteforce them, but can use faster implementations (e.g. .NET 8). So in that case no, actual poor performance is not good, if it only impacts my hashing speed, but not his. Also >3 seconds log in time in total is not UX friendly I think. Commented May 7, 2024 at 9:29
  • 2
    I agree that the best fix is not to use an outdated .NET version. But if you have no choice, there are ways to improve performance, see here. On my machine it's roughly: .NET 8 : .NET Framework 4.8 : NET Framework 4.8 unmanaged = 1 : 4 : 2. Commented May 7, 2024 at 10:05