News for hackers. Stuff that matters.

A comment on Robinhood Stored Passwords in Plaintext. Parent comment

Re:Robinhood Stored Passwords in Plaintext by forty on Wednesday July 24, 2019 @06:54PM (#20520893)
The difference is that the password of scheme 0 is probably reused on many other websites. If for example you bcrypt the password client side, you at least don't have to deal with credentials that might work with all the other websites that your user is using.
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by stevenwliao on Thursday July 25, 2019 @10:39AM (#20525739)
How do you bcrypt at an appropriate difficulty client-side? Consider that it probably needs to work on a mid-range Android phone from years ago.
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by twblalock on Wednesday July 24, 2019 @07:30PM (#20521178)
Password reuse on other sites is not your problem. It is your user's problem.
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by eropple on Wednesday July 24, 2019 @08:23PM (#20521509)
A fuck-you,-got-mine sort of approach to security doesn't work. It's everyone's problem.

PAKEs are probably a good idea across the board.

[ Parent | on HN ]