Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you have an HSM in the loop for all authentications, why bother with hashing? Just encrypt the password database with the HSM and be done with it.

There are cheaper ways of keeping secrets secret. Using a TPM on the server would be one way. SGX would be another.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: