Comment

Comment by tptacek

Why, exactly, would a user ever want to generate a password with a weaker KDF?

A password with lower levels of string complexity might make sense --- 1Password's strong passwords can sometimes be rejected by crappy websites. A password that sacrifices cryptographic strength in order to save a few tens of milliseconds of KDF, though, makes no sense at all.

Also: really, you should not be using PBKDF2.

parent tptacek 10 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton