title: I'm using bcrypt for php and want it to take a long time for a potential hacker to login
body: <p>I am referencing this answer: <a href="https://stackoverflow.com/a/4766811/1114105">https://stackoverflow.com/a/4766811/1114105</a></p>
  
  <p>We re-hash the password, but then we don't really do anything with the hash (we use the POST-submitted plaintext password in the CheckPassword function to authenticate). Can't a hacker bypass the re-hashing part?  </p>
  
  <p>Here's my pseudocode underneath.</p>
  
  <p>if a password/username is submitted by POST and $row['password'] is the hashed pword in sql.</p>
  
  <pre><code>$t_hasher = new PasswordHash(13, FALSE);
  $hash = $t_hasher-&gt;HashPassword($_POST['password']);
  $check = $t_hasher-&gt;CheckPassword($_POST['password'], $row['password']);
  if($check) Great success else Wrong credentials`
  </code></pre>
  
  <p>Note: I found that the work factor does not make a difference in the time it takes CheckPassword to run. It only increases the time for HashPassword.</p>