Hybrid attack splitting

[Larrax]

This indeed solves the problem with timing. However, it creates a whole lot of passwords, which can be a problem to distribute among clients (that could be even geographically distant).

But I guess, with some effort, this can be implemented on the client side, after receiving the one password + mask and some and some extra info about the indexing.

Thank you for this idea, atom!