One thing I wonder about, as password hashes get both processor and memory-hard -- are we presenting a trivial DoS attack on our servers, by basically letting any IP submit a request for a server to dedicate this (non-trivial) level of RAM and processor to a given task (hashing a random string to verify that this login is not correct)?<p>I suppose the answer is yes, but it&#x27;s worth it.  It&#x27;s possible to fix this sort of hole (partially, at least) by capping the number of hashes processed concurrently.  But most simple implementations will just assume &quot;we&#x27;re not likely to have more than X users every signing in concurrently, so we can set the work factors based on that plus some headrooom&quot;.