4 ms·
> use them as forgotten password hashes Please don't. The author tries to trick you into believing it is secure by including a salt. However the resulting key
by dsl 12y ago
> use them as forgotten password hashes
Please don't.
The author tries to trick you into believing it is secure by including a salt. However the resulting key space of the "hash" gives you the same security as a 5-6 character alphanumeric password. A motivated attacker could enumerate all possibilities in a few hours.
- brey 12y agoYou could use that argument to say 4-digit bank card PINs are really bad security - and you'd be right, except that they're always locked out after N attempts. Why not the same approach here? if you try to brute force a password reset, you lock out further attempts for a few minutes.
- krallja 12y agoYou can then use this lockout for a denial of service attack.
- brey 12y agooh no ... I am unable to change my (perfectly secure) password for ten minutes because an attacker is attempting to brute force my password reset. I'd regard that as a feature, not a bug. you don't need to lock out the entire account.