[Cfrg] 答复: Re: ´ð¸´: Re: ´ð¸´: Re: [saag] New draft: Ha shed Password Exchange

[[e-mail]]

Regards~~~

-Sujing Zhou

Steven Bellovin <[e-mail]> 写于 2012-02-13 08:37:08:

> 
> On Feb 12, 2012, at 7:23 PM, [e-mail] wrote:
> 
> > 
> > Regards~~~
> > 
> > -Sujing Zhou 
> > 
> > Steven Bellovin <[e-mail]> 写于 2012-02-12 06:08:41:
> > 
> > > 
> > > On Feb 9, 2012, at 7:35 PM, [e-mail] wrote:
> > > 
> > > > 
> > > > 
> > > > Steven Bellovin <[e-mail]> 写于 2012-02-09 20:32:07:
> > > > 
> > > > > I dealt with that in my note: how do you deal with multiple 
devices? 
> > > > 
> > > > Just copy and paste to all the devices, or retrieve the required 
> > > long key from a USB key. 
> > > > It is seldom required to change, so it does not bring much 
> > > inconvenience, and just an option for users to choose. 
> > > > 
> > > Apart from the fact that I think that that's user-unfriendly, I 
> still don't
> > > understand what problem you are trying to solve. 
> > 
> > To resolve the problem of people haveing almost the same passwords
> saved in almost all the service providers, 
> > by combining a long secret keys and some easy-to-remmeber 
> passwords, with some sacrifice of user-friendliness. 
> > It is an option for people put security ahead of a liitle 
inconvenience. 
> > 
> 
> Because the hashing includes the the service provider, the same password 
on
> different sites will hash to different values, solving that problem 
without
> the inconvenience.
Yes, I know your proposal and I　understand it.
I mean your proposal can have an extra option of hashing (long secret 
key||password||username||servive provider name)
in case people are worry dictionary attack after passwords saved at the 
side of service provider are exposed,
in other words, to add some entropy. 

>       --Steve Bellovin, https://www.cs.columbia.edu/~smb
> 
> 
> 
> 
> 
>