phc-discussions - Re: [PHC] Transforming hash to different cost setting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1502219727.20140322103945@gmail.com>
Date: Sat, 22 Mar 2014 10:39:45 +0100
From: Krisztián Pintér <pinterkr@...il.com>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] Transforming hash to different cost setting

Christian Forler (at Saturday, March 22, 2014, 10:32:45 AM):

> This reasonable assumption implies that profit oriented companies will
> not delete old password hashes.

they also won't use expensive password hashes or forward secrecy.
except if the customer demands it. not necessarily in form of a piece
of technology they don't even understand. but for example in form of
badges. imagine something like "Forler Security seal of approval". if
it has value, and sooner or later it will, those profit oriented
companies will start using everything you say to them.