CBCrypt: Encrypt from the client rather than send passwords to servers

Re:CBCrypt: Encrypt from the client rather than send passwor... by valarauca1 on Tuesday October 06, 2015 @12:20PM (#10339978)

> There should be an authentication module any website could use to store and retrieve credentials from.

How do you plan to do that securely?

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:25PM (#10340017)

Open truefactor:// app. Currently there is only a Web version and it has serious downsides (web crypto is a bad idea), but think of it as a Light version. Desktop apps to come later.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by valarauca1 on Tuesday October 06, 2015 @12:29PM (#10340066)

I was looking for more of a write up. I'm just wondering how/where the credentials get cached and how you securely know the user re-connecting is the user who previously disconnected.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:31PM (#10340084)

Credentials are encrypted with passphrase and seamlessly stored on the server by token=sha256(passphrase). https://truefactor.io/

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by valarauca1 on Tuesday October 06, 2015 @12:38PM (#10340137)

Site gives me a login page. I make a login and I get no information about the service just user options.

Also where is the salt stored? SHA256 is pretty easy to brute force even salted.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:42PM (#10340171)

Email itself is salt (or rather public part of passphrase). So from email+passphrase encryptionKey is derived using scrypt. So it's actually sha(scrypt(email+passphrase))

[ Parent | on HN ]