I'm not trying to define away the possibility of a database compromise, I'm inte... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

hackcasual on April 1, 2015 | parent | context | favorite | on: Enough with the Salts: Updates on Secure Password ...

I'm not trying to define away the possibility of a database compromise, I'm integrating a secure element into the hashing scheme that can compute an HMAC without exposing its key.

tptacek on April 1, 2015 [–]

Wherever you're storing the key, where it's inaccessible to attackers, just store the password.

I'm not even saying that keyed hashes are a bad idea. I'm saying they're orthogonal to the question being discussed on the thread.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact