News for hackers. Stuff that matters.
Re:We'd lose our security certificate if we allowed pasting by KMag on Tuesday May 06, 2014 @02:33PM (#7706291)
It's not common, but running an expensive KDF client-side still greatly slows down a bruit force attack if the password hashes are stolen, without increasing load on your server. The fast one-way function run server-side then prevents the client from being able to submit a stolen hash, forcing an attacker with a list of stolen hashes to perform the full expensive bruit-force attack.

There are no comments on this comment yet.