Why derive a Password
summary
Claims that using derived keys prevents rainbow‑table and GPU brute‑force attacks, shows concrete Android options: PBKDF2 (SecretKeyFactory, API levels noted) and Argon2 via NDK or libs like libsodium, and explains parameters: time iterations, memory cost, parallelism. Recommends per‑user long salts (no reuse), measures target hashing latency ~100–500 ms for mobile, handles migration between algorithms/OS versions, and stores keys with Android Keystore; Argon2 is Dashlane’s default.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 4:26Password hashing
- 7:43Increasing the cost
- 10:49Key derivation
- 13:28Key delivery
- 19:58Security
- 22:09Questions
