2 ms·
It does use data provided from outside: you either need to provide enough valid passwords for it to recreate the secret, or leak data from the stored secrets, a
by akerl_ 11y ago
It does use data provided from outside: you either need to provide enough valid passwords for it to recreate the secret, or leak data from the stored secrets, as described here:
https://github.com/PolyPasswordHasher/PolyPasswordHasher#if-the-attacker-cant-check-individual-accounts-how-does-the-server-check-the-first-account-after-rebooting https://github.com/PolyPasswordHasher/PolyPasswordHasher#if-...
- leni536 11y agoThey leak data but their threat model involves that the attacker can get this leaked data too (they leak it to the hard disk?). >provide enough passwords Why don't they just store some dummy users' (with zero privileges) credentials directly on the hard drive? They simply can provide valid passwords from it after reboot and your attacker can have these passwords since they can't do anything with them. Maybe their leak strategy involves something like this?