On: Poste.io – Complete Mail Server

[zacharyvoase]

Well if you want passwords to be difficult to crack if an attacker gets access to the hashes, you kind of just have to deal with it.

[daneel_w → zacharyvoase]

Yes, and enforcing long passwords is the primary and most important way of dealing with it. Enforcing ridiculously high CPU/RAM use for authenticating is a cost that both sides have to pay, but in itself it doesn't solve the problem at hand.