IETF Logo Mail Archive

Re: [Cfrg] ´ð¸´: Re: ´ð¸´: Re: [saag] New draft: Ha shed Password Exchange

Steven Bellovin <smb@cs.columbia.edu> Mon, 13 February 2012 00:36 UTC

Return-Path: <smb@cs.columbia.edu>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4FC521F8743 for <cfrg@ietfa.amsl.com>; Sun, 12 Feb 2012 16:36:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.687
X-Spam-Level:
X-Spam-Status: No, score=-5.687 tagged_above=-999 required=5 tests=[AWL=0.613, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TBuT8oM2-cyy for <cfrg@ietfa.amsl.com>; Sun, 12 Feb 2012 16:36:58 -0800 (PST)
Received: from paneer.cc.columbia.edu (paneer.cc.columbia.edu [128.59.29.4]) by ietfa.amsl.com (Postfix) with ESMTP id 9EFF121F8742 for <cfrg@irtf.org>; Sun, 12 Feb 2012 16:36:58 -0800 (PST)
Received: from [10.9.0.18] (fireball.cs.columbia.edu [128.59.13.10]) (user=smb2132 mech=PLAIN bits=0) by paneer.cc.columbia.edu (8.14.4/8.14.3) with ESMTP id q1D0aukb023803 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Sun, 12 Feb 2012 19:36:57 -0500 (EST)
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: text/plain; charset="utf-8"
From: Steven Bellovin <smb@cs.columbia.edu>
In-Reply-To: <OF09B457FE.2B0B0E55-ON482579A3.00018C69-482579A3.00022BBA@zte.com.cn>
Date: Sun, 12 Feb 2012 19:37:08 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <6776D5F8-33B2-4266-BB0B-696AB64F41B9@cs.columbia.edu>
References: <OF09B457FE.2B0B0E55-ON482579A3.00018C69-482579A3.00022BBA@zte.com.cn>
To: zhou.sujing@zte.com.cn
X-Mailer: Apple Mail (2.1257)
X-No-Spam-Score: Local
X-Scanned-By: MIMEDefang 2.68 on 128.59.29.4
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] ´ð¸´: Re: ´ð¸´: Re: [saag] New draft: Ha shed Password Exchange
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Feb 2012 00:36:59 -0000

On Feb 12, 2012, at 7:23 PM, zhou.sujing@zte.com.cn wrote:

> 
> Regards~~~
> 
> -Sujing Zhou 
> 
> Steven Bellovin <smb@cs.columbia.edu> 写于 2012-02-12 06:08:41:
> 
> > 
> > On Feb 9, 2012, at 7:35 PM, zhou.sujing@zte.com.cn wrote:
> > 
> > > 
> > > 
> > > Steven Bellovin <smb@cs.columbia.edu> 写于 2012-02-09 20:32:07:
> > > 
> > > > I dealt with that in my note: how do you deal with multiple devices? 
> > > 
> > > Just copy and paste to all the devices, or retrieve the required 
> > long key from a USB key. 
> > > It is seldom required to change, so it does not bring much 
> > inconvenience, and just an option for users to choose.   
> > > 
> > Apart from the fact that I think that that's user-unfriendly, I still don't
> > understand what problem you are trying to solve.  
> 
> To resolve the problem of people haveing almost the same passwords saved in almost all the service providers, 
> by combining a long secret keys and some easy-to-remmeber passwords, with some sacrifice of user-friendliness. 
> It is an option for people put security ahead of a liitle inconvenience. 
> 

Because the hashing includes the the service provider, the same password on
different sites will hash to different values, solving that problem without
the inconvenience.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb

v2.23.0 | Report a Bug | By Email