4 ms·
While true, the risk of exposure is significantly smaller if the derived key is different for every site. The algo can work by the site sending the user their
by Justsignedup 11y ago
While true, the risk of exposure is significantly smaller if the derived key is different for every site.
The algo can work by the site sending the user their personal salt. The algo will then encrypt the password, use the salt, and send the derived key.
This DOES remove the burden on the user of trusting every site with their password. The problem is quickly the password is only but one of a lot of data hackers look for.
- microcolonel 11y agoThat's not necessarily true; If it can generate multiple outputs for the same input, it could mean that the derivation function exposes something about the secret in the degree or nature of the variation.
- xorcist 11y agoIt's hard to quantify risk. Do you rely on the server to play nice, and not present you with fake login boxes, then all bets are off.