2 ms·
The thing is, if the server is already doing all that good stuff with your password, then you're already as well protected as you can be with the current method
by MattPalmer1086 7y ago
The thing is, if the server is already doing all that good stuff with your password, then you're already as well protected as you can be with the current methods.
If it's not, then it probably won't be implementing your protocol either!
I agree that the current methods could be massively improved.
- madacol 7y agoIn the supposed scenario that the server sucks, and it stores directly whatever you sent them, no rounds, no salt, nothing, what you are left with, is whatever protection you did on the client side, so I'm thinking doing the rounds client-side. Now that I'm thinking about it, I don't know how practical it is to do the rounds on a low-spec device like a cheap android