3 ms·
The difference is that the password of scheme 0 is probably reused on many other websites. If for example you bcrypt the password client side, you at least don'
by forty 7y ago
The difference is that the password of scheme 0 is probably reused on many other websites. If for example you bcrypt the password client side, you at least don't have to deal with credentials that might work with all the other websites that your user is using.
- twblalock 7y agoPassword reuse on other sites is not your problem. It is your user's problem.
- eropple 7y agoA fuck-you,-got-mine sort of approach to security doesn't work. It's everyone's problem. PAKEs are probably a good idea across the board.
- stevenwliao 7y agoHow do you bcrypt at an appropriate difficulty client-side? Consider that it probably needs to work on a mid-range Android phone from years ago.