Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Argon2 is slow in the browser, but isn't an inherently slow algorithm.

In other words, you have two algorithms that will each take 1 year on an attacker's machine. Option A takes 1 second on your machine, Option B takes 2 seconds. Option B isn't any better. In fact, it's worse, because it only compromises user experience and potentially leads people down the path of assuming it's more secure than it is.



Oh, so we're talking about different things (not exactly with you, but in the conversation)

I was thinking about the number of interactions (or any other tunable parameter) in the same algorithm, like Scrypt or bcrypt or PBKDF2.

Of course, you're completely right on your example: change one for another that increases time just in browser doesn't give any gain. It must be harder to the attacker...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: