News for hackers. Stuff that matters.

A comment on CBCrypt: Encrypt from the client rather than send passwords to servers. Parent comment

Re:CBCrypt: Encrypt from the client rather than send passwor... by StavrosK on Tuesday October 06, 2015 @11:48AM (#10339670)
You could scrypt on the client.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by ybx on Tuesday October 06, 2015 @11:52AM (#10339726)
You're still passing the output to the server, which can be repeated. Certainly better than just a password, but not as good as public key crypto.

In the end, I'd probably prefer something like SRP

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by imaginenore on Tuesday October 06, 2015 @05:29PM (#10342547)
> You're still passing the output to the server, which can be repeated.

Not if the server generates a unique ID for each attempt, and that ID must be used in hashing. It can be as simple as a timestamp.

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by k3d3 on Tuesday October 06, 2015 @06:54PM (#10342996)
Which is then going beyond just using scrypt on the client. What you explain is simply challenge-response authentication.
[ Parent | on HN ]