meta user
network profile
| bio | website | |
|---|---|---|
| location | California | |
| age | ||
| visits | member for | 11 months |
| seen | Jun 27 '12 at 22:04 | |
| stats | profile views | 1 |
|
Aug 12 |
awarded | Nice Question |
|
Jun 22 |
comment |
Is this password migration strategy secure? I submitted an edit to this answer but it was rejected. If you will make the changes I'll accept this answer. All I'm asking is that you re-order the statements so that they go from most practical to least. Start with that the proposal seems like in improvement, then recommend scrypt as a better solution, then discuss the theoretical attack. Please also note that using a random new_secure_salt that changes each time would protect against that attack, since that is the recommended usage of bcrypt. |
|
Jun 19 |
awarded | Supporter |
|
Jun 18 |
suggested | suggested edit on Is this password migration strategy secure? |
|
Jun 18 |
comment |
Is this password migration strategy secure? Thanks! I like scrypt, but it's too new for me to trust right now and with this scheme we can migrate to scrypt later. In all the systems I'm looking at, an adversary could at best predict, but not choose, the old salt and has no control over the new salt (securely random and unique per user), so the attack would not be practical. |
|
Jun 18 |
revised |
protocol-design wiki description Include excerpt in full tag Wiki, fix typo |
|
Jun 18 |
awarded | Student |
|
Jun 17 |
awarded | Tag Editor |
|
Jun 17 |
revised |
protocol-design wiki excerpt Include excerpt in full tag Wiki, fix typo |
|
Jun 17 |
asked | Is this password migration strategy secure? |
|
Jun 17 |
suggested | suggested edit on protocol-design tag wiki excerpt |
|
Jun 17 |
suggested | suggested edit on protocol-design tag wiki |
|
Jun 12 |
awarded | Teacher |
|
Jun 11 |
answered | What is the difference between known-plaintext attack and chosen-plaintext attack? |
