Re:We'd lose our security certificate if we allowed pasting
by KMag on Tuesday May 06, 2014 @02:33PM
(#7706291)
It's not common, but running an expensive KDF client-side still greatly slows down a bruit force attack if the password hashes are stolen, without increasing load on your server. The fast one-way function run server-side then prevents the client from being able to submit a stolen hash, forcing an attacker with a list of stolen hashes to perform the full expensive bruit-force attack.
[ Parent
| on HN ]
There are no comments on this comment yet.