4 ms·
> Then your password is just the hash and salt. Yes, and by that it appears random. Which is exactly what we want and what password managers provide. > just i
by tomglynch 7y ago
> Then your password is just the hash and salt.
Yes, and by that it appears random. Which is exactly what we want and what password managers provide.
> just inject some JS or redirect a CDN or...
This is the case anyway with regular passwords.
> It doesn't actually add any security is the short story.
Are you sure?
- shakna 7y ago> Yes, and by that it appears random. Which is exactly what we want and what password managers provide. Good sources of randomness, that aren't susceptible to side-channel attacks have only really appeared in browsers (Crypto.getRandomValues) in March of _this_ year. Random is only good if it is a decent CRNG, and we haven't had time to roadtest if we can rely on that yet. Bad random is predictable, in which case you're removing security. > Are you sure? Yes. You're _adding_ a platform that can be attacked, but not introducing anything that is more secure than what is already possible.
- tomglynch 7y agoI don't see what security we would be removing. I am for keeping SSL and server side hashing. I am just suggesting the addition of client side hashing also.