Re: [saag] SHA-1 to SHA-n transition

[Jeffrey Hutzelman <[e-mail]>]

--On Wednesday, March 04, 2009 08:22:45 AM +1300 Peter Gutmann 
<[e-mail]> wrote:

> Jeffrey Hutzelman <[e-mail]> writes:
>
>> Unfortunately, it also creates a fairly signficant set of problems, in
>> that the credentials are no longer portable -- besides needing to know
>> your password, you need a salt that's hidden somewhere in your browser's
>> long-term state.
>
> Yes, I know, and I also knew that every time anyone mentions something
> like this someone immediately raises the point you've just made, which is
> why I addressed it in my original message.

You seem to imply that only weird technical people have or use more than 
one computer.  This is certainly not true; many people have a computer at 
home and one at work, and many of those are quite non-technical.  Computers 
have become commonplace desktop items both in the home and in the office.

Also, telling people "if the disk on your home PC dies, your life is over" 
is a good way to get them _not_ to use a scheme like this.  Saying the 
solution is to always have backups is just going to get you laughed at.

-- Jeff