A bit but not too much, with how sharded out you can do most hash functions, this is why bcrypt/argon2 is so much better.
Only for querying via the server, but that will be so slow even without rate limiting to be near worthless. What will be done is to get a dump of the database, that is why every leak is via one of those.
Seems accurate.
True, this is why original OpenID was so nice (and I strive to support it on a few things I build), that way people host their own authentication on whatever domain they themselves control.
Yet, being honest, these corporations are the most likely ones to get the security right.
Which works fine until they get access to the server anyway, which is the number one reason all those leaks happen. Even with a fully bcrypt/argon2 hashed database (those have built-in unique salts) they can just add their own code to log the HTTP requests for example, passwords and all, and people have a surprising tendency to not notice those things for years.
Secure in that stuff sure, but you’d be surprised at how often those routes aren’t the cause of leaks.
WebAuthn will be a huge help, if implemented well!
This is the Golden Rule of authentication. Everyone gets it wrong, it’s just a matter of who gets it least wrong.
