ayrx

I think you mean Druid instead of Barbarian :)

I don't disagree with your overall point but in the world of high-end watches Rolex watches _are_ mass produced and leverage economies of scale. I think the latest estimates are around 800,000 watches produced per year by Rolex.

You will be part of the rare minority that uses that configuration which by itself is a fingerprint.

To be more exact, what you want is not a slow password hashing algorithm. What you want is an algorithm that is as efficient for the defender as it is for the attacker. The key is that you do not want an attacker to be able to abuse custom hardware or distributed compute in order to gain an efficiency advantage.

It's a nice sentiment but that's how you end up with abandoned, low quality projects that no one uses. Or even worse - abandoned, low quality projects that half the Internet relies on.

Yeah, it was a pain in the early days but I feel like Blizzard has recognised that and are actively taking steps to improve things.

What incentives would a someone have to invest a considerable amount of time in releasing and maintaining an open source project if they can't even use that to promote themselves?

That's actually untrue for Hearthstone.

You can be perfectly competitive without playing arena or buying packs. I haven't paid a cent for the past 2 years and can play all the competitive decks I want in every meta. Blizzard has been very good with bumping up the rewards you get from playing normally.

If you look at his other comments in this I’m not sure it’s sarcasm.

“we deal with it successfully enough in TLS and SSH all the time”

Not quite. Downgrade attacks has been a huge problem for TLS.

You can audit iOS. Security researchers do it all day long.

WordPress has a history of almost embarrassing security vulnerabilities. To be fair, most PHP applications of that era have similar track records.

The newer versions have been _much_ better.