How often does Thunderbird negotiate a login?
 

How often is the password to the mail server when Thunderbird is left open? Sorry if this is the wrong forum, but I am trying to figure out how much a strain bcrypt/scrypt put on a server that does more than just email.

Every time it is set to check the mail, only way to do it on account that requires the login name and password to check it for mail.

Edit: that would be the checking function the encrypted stuff would only be used for the actual decryption of mail fetched.

Each time you "check for mail," a mail client initiates a new session with the mail server – using the password – then checks and receives the mail, then ends the session. However, there is virtually no overhead and therefore no "strain." Encryption algorithms are written to be very efficient. (For instance, your entire interaction with this web site is passing through quite a robust one!)

Halfpower isn't asking about encryption!

Bcrypt and scrypt are key derivation functions - they are written to be deliberately slow, and replace the misuse of fast hashing algorithms in password authentication.

This suggests you don't have enough users for it to matter - otherwise why would you be running it all from a single server?

However, you can probably check server logs to see how frequently email login requests are made at peak times - once you know that, double the rate and run a script on your staging/test server to see what sort of load you might expect, and go from there.

If your server uses IMAP, then I guess it could be no renegotiations at all, depending on timeout configurations:

https://help.hcltechsw.com/domino/11...nlimits_t.html

Thunderbird is set to check for new mail every ten minutes. However, when I leave Thunderbird open, new mail shows up almost as soon as it's received by the server. I'm guessing that a hefty bcrypt/argon2 hasher would be enough to lock up the web server for 1, maybe even a 3, seconds. I don't want to pay for an extra CPU core solely for the purpose of hashing passwords, however, web server performance and security are more important. I think I will have to dig deeper into the email server log files.