12 ms·
Even better best practices: Don't let the server be able to derive the password at all. Have fully P2P user accounts that use PBKDF2 to extend passwords into pr
by marknadal 9y ago
Even better best practices: Don't let the server be able to derive the password at all. Have fully P2P user accounts that use PBKDF2 to extend passwords into proofs that can client-side only decrypt public/private keypairs. For an example, see: https://github.com/amark/gun/wiki/auth https://github.com/amark/gun/wiki/auth