Timeline for Reasonable Password Entropy given a certain Set of argon2 Parameters
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2018 at 17:55 | comment | added | rmalayter | @xwst I’m saying “password-based KDFs do not provide security guarantees, they merely slow down attackers.” They are certainly useful for mitigating the impact of certain attacks, but cannot provide a guarantee of security against hash-cracking when a password hash is exposed. A 128-bit-entropy password can provide such a guarantee against hash-cracking, even if the hash is exposed. | |
| Oct 7, 2018 at 9:53 | comment | added | staxyz | I read your answer as "KDFs don't provide any reliable security", which means that people just use them because they hope that they improve security? You nicely summarized my dilemma. I know that I can use strong passwords, but I don't want to in this special case. (See edit of my question). On a side note, I disagree with you about the passwords. They are a simple and secure solution on an individual basis. I couldn't care less about the fact that other (common?) people are unable to use them properly. | |
| Oct 6, 2018 at 1:48 | comment | added | rmalayter | @Paul_Uszak LastPass/KeePass/1Password do in fact exist, so you don’t have to remember multiple high-entropy passwords. However, we need to retire passwords entirely. Usability of the various passwordless options is still woeful. I’m hopeful about SQRL as an easy-to-use passwordless single-factor, but it’s been “really close to ready” for several years at this point. Who knows what will work... but passwords definitely do not work. | |
| Oct 5, 2018 at 21:42 | comment | added | Paul Uszak | Of course, you're playing the same game as the OP with "high-entropy input password." The higher the entropy, the greater the need to write it down (on a Post-it stuck to the screen). Multiply that by number of passwords. Especially with monthly expiry. A perfect salt mitigates this and adds credence to the question. | |
| Oct 5, 2018 at 14:59 | history | edited | rmalayter | CC BY-SA 4.0 |
Typo
|
| Oct 5, 2018 at 14:47 | history | edited | rmalayter | CC BY-SA 4.0 |
Typo
|
| Oct 5, 2018 at 13:41 | history | answered | rmalayter | CC BY-SA 4.0 |