News for hackers. Stuff that matters.

A comment on CBCrypt: Encrypt from the client rather than send passwords to servers. Parent comment

Re:CBCrypt: Encrypt from the client rather than send passwor... by ybx on Tuesday October 06, 2015 @11:53AM (#10339743)
The idea is that you're implicitly trusting the company (or website), as well as anyone who has (whether legit or not) access, to only keep that password in memory, and it's preferable to authenticate without requiring that trust.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by aggieben on Tuesday October 06, 2015 @05:46PM (#10342645)
I can agree to this: this allows a user to not have to trust that the company running the application set up password authentication properly.

But still: I just can't get worked up about this at all. I'd rather see pgp get implemented in browsers before this.

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by k3d3 on Tuesday October 06, 2015 @07:12PM (#10343090)
You can already use TLS client certificates - the UI is just terrible is all.
[ Parent | on HN ]