2

Does Hash/Salted password really help when DB is compromised? really does answer your question, but there looks like there is a language issue. So I will explain in a different way. If we only hashed passwords, and not salted them, then commonly used passwords would all look the same. The password password in MD5 on every system in the world will always be: ...


1

... hash value(as ECC private key) -> generate public key from private key You are assuming that an arbitrary key (output of a hash) can be used as an ECC private key and that the public key can be derived from this. This is not how it works though. If you want to derive a key pair from an existing random string or passphrase you would need to use some ...


1

Argon2 is not meant to protect anything against MITM. It's not the right tool for the job. Using Argon2 on the client side (with or without TLS) will force you to either store the plaintext password on the server side, or it will make the hash become the password: in both cases you end up usually worse than when sending the plaintext password over TLS. You ...


1

This is a problem I've been trying to solve for a while, but I'm not ready to share a complete solution, since I'm still working on it. For now, I will only share some details and general principles. The problem of password managers is that they introduce a single point of failure, that is, once your machine is infected all the passwords might be used by the ...


Only top voted, non community-wiki answers of a minimum length are eligible