←back to thread

Evaluating Argon2 adoption and effectiveness in real-world software

(arxiv.org)
32 points pregnenolone | 1 comments | 15 Oct 25 06:29 UTC | HN request time: 0.244s | source
Show context
tialaramex ◴[22 Oct 25 10:39 UTC] No.45667165[source]▶
"Real-World Software" maybe but not real world effectiveness.

A lot of effort was expended on modelling the hypothetical thing Argon2 is good at, but a reasonable question is: Does that make any real world difference? And my guess is that the answer, awkwardly, is approximately No.

If you use good passwords or you have successfully stopped using passwords in the decades we've known they're a bad idea, Argon2 makes no difference at all over any of the other reasonable choices, and nor does its configuration. If you figure that nobody will remember your password is hunter2 then Argon2 can't help you either. If the attack being undertaken is an auth bypass, Argon2 can't help. If they're stealing credentials, Argon2 can't help.

replies(4): >>45667502 #>>45667528 #>>45668627 #>>45678505 #
1. helpfulclippy ◴[22 Oct 25 13:14 UTC] No.45668627[source]▶
Strong hashes aren’t so useful for you the individual with a high entropy per-site password… they’re useful for responsible organizations trying to proactively mitigate the impact of a future data breach on users with bad password habits (which is a lot of users).

If ClownCo gets hacked that’s bad. If ClownCo gets hacked and discloses millions of sets of credentials, it is now enabling a new wave of credential stuffing attacks.