Posted by Alexander Mueller on 01/09/08 17:58

J.O. Aho wrote:
>
> I can't see any extra advantage of your input has, more than it will just
> consume more bandwidth for transporting the data.

As to the traffic, yes, it will generate more traffic as long as the
actual password is shorter than the hash (32 bytes for MD5, 40 bytes for
SHA1). But considering only a 5 byte long password I would say the extra
traffic of 27-35 bytes is worth the added security (some HTTP headers
often take more).

Alexander

[Back to original message]