3 ms·
Surely this is just a data compression exercise - proved by the fact that where the database is small enough to be downloaded and stored locally, the vulnerabil
by chrisjj 10mo ago
Surely this is just a data compression exercise - proved by the fact that where the database is small enough to be downloaded and stored locally, the vulnerability need not exist.
- csp_dev 10mo agoYou’ve summed it up perfectly. This is fundamentally about the trade-off between total privacy (local DB) and practicality (server query). The protocol exists only if that middle ground has real users. The compelling case might not be for individuals, but for organizations that must prove due diligence in password screening for compliance like for example, ISO 27001, but want to minimize their own liability and logging footprint.