How crackers ransack passwords like “qeadzcwrsfxv1331”

Re:How crackers ransack passwords like “qeadzcwrsfxv1331” by chongli on Tuesday May 28, 2013 @07:32AM (#5779326)

>It's also theoretically impure in any case, as you've done nothing but add an additional peripheral to the computer. You're seeking obfuscation, not real cryptographic integrity.

It's not obfuscation. The peripheral has a far smaller attack surface than a server. This is real security, even if it comes at a cost of reliability (though one can envision ways of fixing this, too).

[ Parent | on HN ]

Re:How crackers ransack passwords like “qeadzcwrsfxv1331” by nknighthb on Tuesday May 28, 2013 @07:51AM (#5779375)

It's operational/system security. That's not the same thing as cryptographic security.

Stop trying to patch a hole that isn't there. Salt is not secret data. If you want to protect the hash with secret data, take A1kmm's advice and use the smart card to encrypt it. But don't call that a salt, because it fundamentally is not one.

[ Parent | on HN ]