News for hackers. Stuff that matters.

A comment on CBCrypt: Encrypt from the client rather than send passwords to servers. Parent comment

Re:CBCrypt: Encrypt from the client rather than send passwor... by devit on Tuesday October 06, 2015 @12:04PM (#10339862)
That would destroy security, since a compromised server could now get your password by serving malicious JavaScript...
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by jonknee on Tuesday October 06, 2015 @12:24PM (#10340014)
Can't a compromised server already get your password by serving malicious JavaScript?
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by Stefan-H on Tuesday October 06, 2015 @12:29PM (#10340063)
A malicious server doesn't need malicious javascript to do it, it already receives the password in the plain, but that is what is trying to be mitigated in these efforts.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by jessaustin on Tuesday October 06, 2015 @03:34PM (#10341696)
So you agree that a js lib would be an improvement over the status quo?
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by Stefan-H on Tuesday October 06, 2015 @07:00PM (#10343029)
Using a JS lib would not mitigate any risk here unless the compromising of the server that hosts the JS is separate from the compromsing of your web server.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by k3d3 on Tuesday October 06, 2015 @07:06PM (#10343058)
It mitigates passive MITM attacks, for one.

On the other hand, there's nothing that's made _worse_ by choosing to do it that way. Plenty of things that are the same, some things better, but nothing worse.

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by Stefan-H on Wednesday October 07, 2015 @11:52AM (#10346720)
Hardly - if you are not using HTTPS in the first place then sending the hash across the wire instead of the password are the least of your worries.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by jonknee on Tuesday October 06, 2015 @12:37PM (#10340127)
I was thinking a malicious 3rd party JS (say a CDN copy of jQuery or something).
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by k3d3 on Tuesday October 06, 2015 @07:07PM (#10343062)
You might find interest in https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...
[ Parent | on HN ]