CBCrypt: Encrypt from the client rather than send passwords to servers

Re:CBCrypt: Encrypt from the client rather than send passwor... by Freaky on Tuesday October 06, 2015 @01:26PM (#10340605)

People generally aren't carefully clearing passwords from memory after use, and ideally GC runs aren't happening all that often. "Exactly the right moment" could easily extend out to many minutes.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by aggieben on Tuesday October 06, 2015 @05:43PM (#10342632)

Right. So there's an I suppose in there somewhere, and my response is still pretty much: "meh". The people who might could possibly get access to that password already have access to all the data being protected by that password, and if they were so hell-bent on using your password to break into other sites, they could do that anyway by brute forcing what CBCrypt produces.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by Freaky on Wednesday October 07, 2015 @10:49AM (#10346334)

Brute forcing a password hash is a lot different from being able to trivially extract it from memory long after it's been used.

[ Parent | on HN ]