Post #4282095
2026-07-31 14:48 UTC
@Javvad@infosec.exchange I tell people over and over: unique is more important than strong. Your password can be as security as you want, but if your Pokemon forum with plaintext passwords gets dumped it doesn't matter
Until sites are forced to attest to which password scheme they use, worrying strong password hashing feels exceedingly pointless.
Replies (1)
-
@mcc@mastodon.social 2026-07-31 14:54
@iagox86@infosec.exchange @Javvad@infosec.exchange Another thing: We shouldn't be sending passwords over the wire. If your Pokemon forum uses Argon2, but the php script (due to compromise or accident) logs its POST variables to a file, the Argon2 is useless. Protocols like SRP for password login without transmission have existed for decades, but were never deployed, instead we tried replacing passwords entirely with passkeys, an overcomplicated, restrictive solution that (apparently) not everyone is willing to put up with.