3 ms·
It seems to me like that fits somewhere in the space between "small compromise" and "bonus feature". This idea seems like a very good practical solution--I'm ve
by napoleond 13y ago
It seems to me like that fits somewhere in the space between "small compromise" and "bonus feature". This idea seems like a very good practical solution--I'm very curious what moxie's take on it would be.
- maxerickson 13y agoIf the design goal is to not trust the server, it is still pretty useless. Say you make the hash take 1 second on a phone. Without trying to really pin it down, I think an attacker would be able to do an area code in hours with minimal investment. They could do the entire phone number space fairly quickly for a modest investment. (My attacker there is focusing on the pairs for one number. The area code part comes in because phone numbers really are lumpy like that.)