3 ms·
Is it wrong to think of you as really secure, off site salt provider? At the end of the day you are just providing a really good source secure random bytes that
by canes123456 10y ago
Is it wrong to think of you as really secure, off site salt provider? At the end of the day you are just providing a really good source secure random bytes that are stored for the user.
What is the security benefit of sending you the actual hash of the password? Why not just the hash of a unique user token?
- zaroth 10y agoThat's a good way to think of it. It's important to use the password as part of the entropy so that an attacker has to make a Blind Hashing request for each attempt to crack a password versus being able to make a single request to effectively unblind it.
- canes123456 10y agoActually, I think a better way to describe this is user specific peppers instead of calling it a salt.
- rthille 10y agoThe thing sent to their service shouldn't be known by anyone but the user, then it can't be stolen from the website.