101 reputation
1
bio website
location
age
visits member for 1 year, 9 months
seen Jan 19 '13 at 1:39

Jan
19
awarded  Supporter
Jan
19
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
Oh, of course. I was thinking we had to store the HMAC output, but we don't since we calculate it again from the password that the user sent for login. Thanks again.
Jan
18
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
Could you please explain the "best of both worlds" solution. I'm confused, because if we apply HMAC on the password using a key, apply bcrypt on the result of the HMAC, and then store that digest, how could we ever get the result of the HMAC back so that we can do our password/HMACkey verification? I feel I'm missing some vital part, and this is all very new for me. Thanks.