Another one with similar graphics might have been “HTML Goodies”
If passwords were hashed+salted client-side, an attacker could use the hash+salt in exactly the same way as they would a 'raw' password. So the answer is no; the strength measurement would be done on the server when the…
Here's a link to the mentioned video: http://www.youtube.com/watch?v=ekv0kprA3AY
I was simply trying to clarify the challenge-response mechanism for the parent poster, not suggesting you use keychain dongles everywhere. Regardless, the idea that the plaintext password doesn't have to leave the…
The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since…
Another one with similar graphics might have been “HTML Goodies”
If passwords were hashed+salted client-side, an attacker could use the hash+salt in exactly the same way as they would a 'raw' password. So the answer is no; the strength measurement would be done on the server when the…
Here's a link to the mentioned video: http://www.youtube.com/watch?v=ekv0kprA3AY
I was simply trying to clarify the challenge-response mechanism for the parent poster, not suggesting you use keychain dongles everywhere. Regardless, the idea that the plaintext password doesn't have to leave the…
The server sends a challenge to the client. The client computes response = f(challenge, password), and sends the response. Then the server compares the response with its own computation of f(challenge, password). Since…