2 ms·
No, dom0 is right. You are spending 2sec computing the result in browser JavaScript. The attacker will throw JS out of the window and spend 0.01sec in hand-opt
by Quiark 10y ago
No, dom0 is right.
You are spending 2sec computing the result in browser JavaScript. The attacker will throw JS out of the window and spend 0.01sec in hand-optimized C++ or OpenCL code. You gain no security.
- woliveirajr 10y agoDon't get it, would you mind to elaborate? Because, IMHO, the attacker will always use optimized resources. Be it algorithm, cpu speed, gpu, and so on. If I double the number of interactions, it'll take more or less twice the time. For me or for the attacker. So I'll trade twice my time vs twice his time. He can reduce his time having more cpu, gpu or finding a better algorithm.
- kgreene2 10y agoArgon2 is slow in the browser, but isn't an inherently slow algorithm. In other words, you have two algorithms that will each take 1 year on an attacker's machine. Option A takes 1 second on your machine, Option B takes 2 seconds. Option B isn't any better. In fact, it's worse, because it only compromises user experience and potentially leads people down the path of assuming it's more secure than it is.
- woliveirajr 10y agoOh, so we're talking about different things (not exactly with you, but in the conversation) I was thinking about the number of interactions (or any other tunable parameter) in the same algorithm, like Scrypt or bcrypt or PBKDF2. Of course, you're completely right on your example: change one for another that increases time just in browser doesn't give any gain. It must be harder to the attacker...