Re:How To Safely Store A Password
by joshu on Wednesday December 15, 2010 @05:43AM
(#2007670)
Dumb idea:
Have the work factor also be a function of the password itself... this would cause even more difficulty brute-forcing the password, as it means intermediate steps would also have to be tested - breaking one weak password doesn't give you any information about other passwords.
Re:How To Safely Store A Password
by StavrosK on Wednesday December 15, 2010 @05:52AM
(#2007679)
I'm not sure about the bcrypt implementation, but if the work factor is public (i.e. you have to know it before calculating the hash), this gives you information about the password, which is bad.
Have the work factor also be a function of the password itself... this would cause even more difficulty brute-forcing the password, as it means intermediate steps would also have to be tested - breaking one weak password doesn't give you any information about other passwords.