31–40 of 78 posts
I'd like to use Argon2 for web stuff but Web Crypto doesn't support it yet ( https://github.com/WICG/proposals/issues/59 ) and the WASM flavor creates problems with bundling and testing. Stuck with PBKDF2 for now...
An algorithm that requires a ton of memory doesn't really make sense for web applications IMHO. bcrypt and bscrypt are better choices.
I'd like to use Argon2 for web stuff but Web Crypto doesn't support it yet ( https://github.com/WICG/proposals/issues/59 ) and the WASM flavor creates problems with bundling and testing. Stuck with PBKDF2 for now...
An algorithm that requires a ton of memory doesn't really make sense for web applications IMHO. bcrypt and bscrypt are better choices.
Or really anything where you need or want client side encryption protected by a passport.
Earlier quoted context omitted.
Equal rights for everyone, anyone can use any account. Later on, and still today as default in GNU software, he also objected to the 'wheel' group that would restrict the ability to call 'su' to just the members of 'wheel'. He wanted everyone who somehow obtained the root password to be able to become root.
"Why do you need a password? What are you hiding?"
> This came over the strenuous objections of Richard Stallman who famously tried to resist the introduction of passwords at MIT in the 1970s (Levy, 1984). Out of curiosity, what was his competing proposal?
Background to his desire for open (non locked down) systems (covers the period when the MIT AI lab went from the completely open in-house developed ITS to a proprietary Digital system): https://www.gnu.org/philosophy/stallman-kth.en.html "...But that machine wasn't designed also to support the phenomenon called “tourism.” Now “tourism” is a very old tradition at the AI lab, that went along with our other forms of ana…
Due to my mental illness I always forget my passwords. It annoys me because frankly aside from my email and bank account IDGAF about the rest of my online identity. But no I need to have a 12 character password for the supermarket app!
* https://www.wired.com/story/bcrypt-password-hashing-25-years...
bscrypt is a modern alternative to bcrypt; also cache-hard and more suitable than Argon2 and Scrypt: cache-hard, easier to deploy on multi-user environments, as well as web browsers/mobile devices. https://github.com/Sc00bz/bscrypt
Earlier quoted context omitted.
Also, all the standards were crap. HTTP got basic auth, which is crap because plaintext password transmission happens, also the browsers never got around to implement any sensible UI (e.g. you cannot log off). Then it got digest auth, which at least wasn't plaintext in transmission, but required plaintext password storage on the server. Then came negotiate, which only worked with some proprietary products, had even w…
Since everything is TLS now, basic auth no longer transmits in the clear. But I agree browser vendors have refused to bother putting in even the bare minimum of effort for years. I've been subscribed to the firefox ticket to allow http auth logout for my entire adult life.
It would be cool if the challenge could specify the URL of an image to appear in the login dialog.