Hashing doesn't have much of a use when there are only 10k possible inputs.
Even using bcrypt set to take 1 second to verify a hash wouldn't be great -- it'd take about two hours and 45 minutes to break a PIN. And yes, while this is significantly better than not hashing at all (where it takes no time to get a pin) it would be trivial to target specific people to get their pin's given the hashed database.
Sure, you could make it take 10 seconds to verify a hash, but now all you've done is make me take a day to break the pin.
Comments
Hashing doesn't have much of a use when there are only 10k possible inputs.
Even using bcrypt set to take 1 second to verify a hash wouldn't be great -- it'd take about two hours and 45 minutes to break a PIN. And yes, while this is significantly better than not hashing at all (where it takes no time to get a pin) it would be trivial to target specific people to get their pin's given the hashed database.
Sure, you could make it take 10 seconds to verify a hash, but now all you've done is make me take a day to break the pin.