Re: [saag] SHA-1 to SHA-n transition

[Nicolas Williams <[e-mail]>]

On Wed, Mar 04, 2009 at 05:34:15AM +1300, Peter Gutmann wrote:
> Jeffrey Hutzelman <[e-mail]> writes:
> >How do you expect users to remember not to give away their passwords when
> >they can't be bothered to remember to wash their hands or look both ways
> >before crossing a street?
> 
>  site_password = HMAC( user_password || 128-bit salt, site_URL );

I've had sundry such browser plugins installed and I still don't use
them.  I tried, but I stopped when I noticed that using such passwords
in my cell phone was a royal PITA.

Thanks, you've managed to depress me :)

You've also disproved my point and proved EKR's.  The clarity is welcomed.