3 ms·
> - Why do the weird PBDKF2 derivation here? It's not based on a password the player enters, so there's nothing to "strengthen"? Seems oddly unnecessary (or I d
by kuschku 2y ago
> - Why do the weird PBDKF2 derivation here? It's not based on a password the player enters, so there's nothing to "strengthen"? Seems oddly unnecessary (or I don't understand and there's a password somewhere).
If you set a master password, firefox uses that master password instead as input to PBKDF2.
- jackjeff 2y agoAb yeah. In that case it makes perfect sense. But honestly I’d stay away from PBDKF2 at this stage. If you look at OWASP they recommend 600k rounds. That number is getting bigger and bigger all the time (10k rounds used to be enough over a decade ago) https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2 https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor... I would use Argon or scrypt (which is basically PBKDF2 in a loop with some weird mixes) instead.