Timeline for Using a password hash...as the password?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 16, 2015 at 0:53 | comment | added | Reid Rankin | One bit of good news with these schemes is that they discard a lot of output bits. That means that the attacker will (probably) get a lot of false positives. | |
| Nov 16, 2015 at 0:50 | comment | added | stiabhan | The use of HMAC is much better than simply catenating the password to the sitename Not that it matters - the approach is flawed because hashes are simply too fast/cheap to compute to be considered safe for this purpose. Being cheap to compute allows an adversary who has the site-specific password and a guess at the plaintext (the site name +/- some info) to launch a dictionary or brute-force attack against the master password. That's the reason for bcrypt and scrypt - they are deliberately expensive in terms of memory and CPU cycles in order to thwart dictionary and brute force-force attacks. | |
| Nov 15, 2015 at 3:46 | vote | accept | user97462 | ||
| Nov 15, 2015 at 3:12 | history | answered | Reid Rankin | CC BY-SA 3.0 |