Hack of Cupid Media dating website exposes 42 million plaintext passwords

Re:Hack of Cupid Media dating website exposes 42 million pla... by nitrogen on Wednesday November 20, 2013 @12:41PM (#6769520)

Is there a variant of SRP that would provide the same level of protection against a server hack as bcrypt?

Edit: it looks like it should be possible to replace H() in SRP with bcrypt or scrypt. Wouldn't that mitigate brute forcing from server hashes?

[ Parent | on HN ]

Re:Hack of Cupid Media dating website exposes 42 million pla... by tptacek on Wednesday November 20, 2013 @01:19PM (#6769851)

Yes, in the same way that simply using scrypt would.

But, of course, the point isn't that SRP is a weak construction. The point is "client side stretching", whatever that was intended to mean, has nothing to do with the problem of losing a database of password "verifiers", be they plaintext, salted hashes, password hashes, or SRP v-values.

[ Parent | on HN ]