News for hackers. Stuff that matters.

A comment on Everything you need to know about cryptography in 1 hour. Parent comment

Re:Everything you need to know about cryptography in 1 hour by lsc on Friday May 14, 2010 @06:39AM (#1347012)
Yeah. But really, I was hoping someone had come up with a way to make something like client certs usable. a six character completely random password (even if it's all lower-case without punctuation) is a damn sight better than your average password.

Can you tell me more about allowing the user to cache the derived key within the context of web applications? that would mitigate the limitation I was describing (where how slow you made the password check was limited by what delay a user would tolerate when logging in.)

[ Parent | on HN ]
Re:Everything you need to know about cryptography in 1 hour by JoachimSchipper on Friday May 14, 2010 @06:49PM (#1348837)
I don't think this is really suitable for web applications. Javascript really sucks at crypto (due to the lack of suitable data types), and requiring Java wouldn't fly with too many people (Flash is sort of in-between, I guess?). There is a very large constant factor here, so and since the whole point of this key derivation stuff is to make an attacker work harder...
[ Parent | on HN ]