News for hackers. Stuff that matters.
Re:A Message to Our Customers by charlieegan3 on Wednesday February 17, 2016 @08:06AM (#11117560)
You can't make crypto behave slower on repeated attempts but you can still make each attempt more expensive. For example: https://en.m.wikipedia.org/wiki/Pepper_(cryptography)
Re:A Message to Our Customers by 0942v8653 on Wednesday February 17, 2016 @08:33AM (#11117682)
True. But Apple, with such a focus on UX, cannot reasonably afford more than ~200 millisec when checking a password; and still it scales linearly, so the solution for concerned users still involves creating a more complex password. Doubling the amount of time it takes to hash a password will have the same effect as adding 1 more bit of entropy to the password, which can easily be beaten by adding a single character to it.
Re:A Message to Our Customers by daeken on Wednesday February 17, 2016 @09:46AM (#11118135)
If you consider caching of keys, there's no reason that the first login attempt after a cold boot couldn't take 1-2s. Each subsequent login would be roughly instant.