Re: [Cfrg] ´ð¸´: Re: ´ð¸´: Re: [saag] New draft: Ha shed Password Exchange

[Steven Bellovin <[e-mail]>]

On Feb 12, 2012, at 7:43 PM, [e-mail] wrote:

> 
> Regards~~~
> 
> -Sujing Zhou 
> 
> Steven Bellovin <[e-mail]> 写于 2012-02-13 08:37:08:
> 
> > 
> > On Feb 12, 2012, at 7:23 PM, [e-mail] wrote:
> > 
> > > 
> > > Regards~~~
> > > 
> > > -Sujing Zhou 
> > > 
> > > Steven Bellovin <[e-mail]> 写于 2012-02-12 06:08:41:
> > > 
> > > > 
> > > > On Feb 9, 2012, at 7:35 PM, [e-mail] wrote:
> > > > 
> > > > > 
> > > > > 
> > > > > Steven Bellovin <[e-mail]> 写于 2012-02-09 20:32:07:
> > > > > 
> > > > > > I dealt with that in my note: how do you deal with multiple devices? 
> > > > > 
> > > > > Just copy and paste to all the devices, or retrieve the required 
> > > > long key from a USB key. 
> > > > > It is seldom required to change, so it does not bring much 
> > > > inconvenience, and just an option for users to choose.   
> > > > > 
> > > > Apart from the fact that I think that that's user-unfriendly, I 
> > still don't
> > > > understand what problem you are trying to solve.  
> > > 
> > > To resolve the problem of people haveing almost the same passwords
> > saved in almost all the service providers, 
> > > by combining a long secret keys and some easy-to-remmeber 
> > passwords, with some sacrifice of user-friendliness. 
> > > It is an option for people put security ahead of a liitle inconvenience. 
> > > 
> > 
> > Because the hashing includes the the service provider, the same password on
> > different sites will hash to different values, solving that problem without
> > the inconvenience.
> Yes, I know your proposal and I　understand it. 
> I mean your proposal can have an extra option of hashing (long secret key||password||username||servive provider name) 
> in case people are worry dictionary attack after passwords saved at the side of service provider are exposed, 
> in other words, to add some entropy.   
> 
Ah, a secret salt.  I'll think about it -- that's a very different meaning
to "salt" than is customarily used.


		--Steve Bellovin, https://www.cs.columbia.edu/~smb