2 ms·
you might want to look at this ( https://news.ycombinator.com/item?id=5033540 https://news.ycombinator.com/item?id=5033540 ) comment on why the PBKDF2 is sent f
by n0on3 14y ago
you might want to look at this ( https://news.ycombinator.com/item?id=5033540 https://news.ycombinator.com/item?id=5033540 ) comment on why the PBKDF2 is sent for the authentication rather than the password.
As far as concerns the usage of TLS, your guess is correct, right now we allow the usage of the most common cipher suites, with some of them not providing PFS.
However, the negotiation of cipher suite is just a matter of configuration, and we might take a closer look pretty soon on which ones we want to allow or not.
- darkarmani 14y agoI saw that. I guess the problem is that for authentication I hope that the PBKDF2 hash is further hashed before sticking it in the DB to protect against DB compromises.