1

First of all, let me say that your scenario is quite bad. Storing copies of personal information on an unsecured laptop that people could rob rings a number of bells, and my first instinct would be to ask why do you really need to do that?? It may be possible to handle it on a better way. And even if budget restrictions are a concern, do note that they need ...


1

Timing step 2 does leak information. In order for it not to, you'd need a database implementation where hits and misses take the same amount of time. It is probably more important, though, that you run step 3 unconditionally. If a username is not in the database, then use a dummy value for the salt and execute your password hash using the same configuration ...


Only top voted, non community-wiki answers of a minimum length are eligible