joh6nn

14 ms·

1. 121.▲
   by joh6nn 16y ago

   "this proposal" was meant to refer to the article, not SRP. hence my comment that we're measuring it against the wrong metrics: it's no surprise that this proposal doesn't stack up when compared to SRP, since, to my reading, it isn't meant
2. 122.▲
   by joh6nn 16y ago

   "it's a Unix system; I know this!"
3. 123.▲
   by joh6nn 16y ago

   this is already available for the major browsers as an extension; try googling for "pwd hash" (from stanford) and "password hasher". also, as was noted in another comment, this is currently being discussed in another thread
4. 124.▲
   by joh6nn 16y ago

   He's correct that SRP is really the relevant standard for the full authentication system here, as well. see, this is one of the places where I get confused. i don't read this proposal as being an authentication system. i read it as bein
5. 125.▲
   by joh6nn 16y ago

   i'm not sure i understand why that's a failure. my understanding is that's the point: every user now has a password that is unique on a per-domain basis. i don't understand this to be an attempt to protect against the kind of attack that