3 ms·
But is it? If the only way your production server can check passwords is by sending hash(salt+pw+salt) and getting a true\false reply from a piece of external
by Drakim 14y ago
But is it?
If the only way your production server can check passwords is by sending hash(salt+pw+salt) and getting a true\false reply from a piece of external hardware...then even if an intruder got complete control though some exploit or injection, he wouldn't be able to dump the database for later cracking with rainbow tables.
- shabble 14y agoYou may have just re-invented the Hardware Security Module(HSM)[1] :-) See also [2] for a cute implementation using an Arduino to secure an AWS API key [1] https://en.wikipedia.org/wiki/Hardware_security_module https://en.wikipedia.org/wiki/Hardware_security_module [2] http://stefan.arentz.ca/signing-aws-requests-with-your-arduino.html http://stefan.arentz.ca/signing-aws-requests-with-your-ardui...