News for hackers. Stuff that matters.

A comment on Notifying administrators about unhashed password storage. Parent comment

Re:Notifying administrators about unhashed password storage by pfortuny on Wednesday May 22, 2019 @07:48AM (#19980100)
There is a better way: use an oracle-like device whose secret key is unavailable.

See (shameful plug) http://thesybil.net

Yes, it is academic but it should be everywhere.

I improved it to perform client-side hashing and encryption but have had not the time to update the docs.

[ Parent | on HN ]
Re:Notifying administrators about unhashed password storage by progval on Wednesday May 22, 2019 @08:35AM (#19980445)
I can't connect, the domain does not resolve.

But sure, there are good solutions to this, like SCRAM. Unfortunately, there is not much point when the authentication code is controlled by the server (eg. JS served by a server)

[ Parent | on HN ]
Re:Notifying administrators about unhashed password storage by pfortuny on Wednesday May 22, 2019 @12:08PM (#19982649)
Sorry, I always forget the order: http://thesibyl.net
[ Parent | on HN ]