On Wed, Mar 04, 2009 at 05:34:15AM +1300, Peter Gutmann wrote: > Jeffrey Hutzelman <jhutz at cmu.edu> writes: > >How do you expect users to remember not to give away their passwords when > >they can't be bothered to remember to wash their hands or look both ways > >before crossing a street? > > site_password = HMAC( user_password || 128-bit salt, site_URL ); I've had sundry such browser plugins installed and I still don't use them. I tried, but I stopped when I noticed that using such passwords in my cell phone was a royal PITA. Thanks, you've managed to depress me :) You've also disproved my point and proved EKR's. The clarity is welcomed.
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.