Re:BitAuth for Decentralized Authentication
by pencilcode on Wednesday July 02, 2014 @05:11AM
(#7975908)
That's right. But it does reduce the cost of a compromised server. Since no passwords are stored in the server itself, if it's compromised, the user's passwords won't be exposed (even if they're encrypted, they're often weakly encrypted, especially as time goes by).
[ Parent
| on HN ]
Re:BitAuth for Decentralized Authentication
by randomtask on Wednesday July 02, 2014 @05:38AM
(#7975995)
Passwords should usually not be encrypted. Saying a password is encrypted implies that there is a decryption function that can produce the original password in plaintext. This should not be the case. Instead, typically, a key derivation function like bcrypt, scrypt, etc. is applied. The output of these are sometimes referred to as "password hashes" because like hashes they are not reversible.
Re:BitAuth for Decentralized Authentication
by pencilcode on Wednesday July 02, 2014 @05:45AM
(#7976008)
Yes, my mistake. I meant hashed.