Subject: Re: [Cfrg] ´ð¸´: Re: ´ð¸´: Re: [saag] New draft: Ha shed Password Exchange

From: Steven Bellovin <[email-masked]>
Date: Sun, 12 Feb 2012 19:37:08 -0500

On Feb 12, 2012, at 7:23 PM, [email-masked] wrote:

> 
> Regards~~~
> 
> -Sujing Zhou 
> 
> Steven Bellovin <[email-masked]> 写于 2012-02-12 06:08:41:
> 
> > 
> > On Feb 9, 2012, at 7:35 PM, [email-masked] wrote:
> > 
> > > 
> > > 
> > > Steven Bellovin <[email-masked]> 写于 2012-02-09 20:32:07:
> > > 
> > > > I dealt with that in my note: how do you deal with multiple devices? 
> > > 
> > > Just copy and paste to all the devices, or retrieve the required 
> > long key from a USB key. 
> > > It is seldom required to change, so it does not bring much 
> > inconvenience, and just an option for users to choose.   
> > > 
> > Apart from the fact that I think that that's user-unfriendly, I still don't
> > understand what problem you are trying to solve.  
> 
> To resolve the problem of people haveing almost the same passwords saved in almost all the service providers, 
> by combining a long secret keys and some easy-to-remmeber passwords, with some sacrifice of user-friendliness. 
> It is an option for people put security ahead of a liitle inconvenience. 
> 

Because the hashing includes the the service provider, the same password on
different sites will hash to different values, solving that problem without
the inconvenience.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb

---

From: [email-masked]
Date: Mon, 13 Feb 2012 08:43:03 +0800

Regards~~~

-Sujing Zhou

Steven Bellovin <[email-masked]> 写于 2012-02-13 08:37:08:

> > To resolve the problem of people haveing almost the same passwords
> saved in almost all the service providers, 
> > by combining a long secret keys and some easy-to-remmeber 
> passwords, with some sacrifice of user-friendliness. 
Yes, I know your proposal and I　understand it.
I mean your proposal can have an extra option of hashing (long secret 
key||password||username||servive provider name)
in case people are worry dictionary attack after passwords saved at the 
side of service provider are exposed,
in other words, to add some entropy.

---

From: Steven Bellovin <[email-masked]>
Date: Sun, 12 Feb 2012 19:50:54 -0500

On Feb 12, 2012, at 7:43 PM, [email-masked] wrote:

> I mean your proposal can have an extra option of hashing (long secret key||password||username||servive provider name) 
> in case people are worry dictionary attack after passwords saved at the side of service provider are exposed, 
Ah, a secret salt.  I'll think about it -- that's a very different meaning
to "salt" than is customarily used.