News for hackers. Stuff that matters.

A comment on CBCrypt: Encrypt from the client rather than send passwords to servers. Parent comment

Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:25PM (#10340017)
Open truefactor:// app. Currently there is only a Web version and it has serious downsides (web crypto is a bad idea), but think of it as a Light version. Desktop apps to come later.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by valarauca1 on Tuesday October 06, 2015 @12:29PM (#10340066)
I was looking for more of a write up. I'm just wondering how/where the credentials get cached and how you securely know the user re-connecting is the user who previously disconnected.
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:31PM (#10340084)
Credentials are encrypted with passphrase and seamlessly stored on the server by token=sha256(passphrase). https://truefactor.io/
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by valarauca1 on Tuesday October 06, 2015 @12:38PM (#10340137)
Site gives me a login page. I make a login and I get no information about the service just user options.

Also where is the salt stored? SHA256 is pretty easy to brute force even salted.

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:42PM (#10340171)
Email itself is salt (or rather public part of passphrase). So from email+passphrase encryptionKey is derived using scrypt. So it's actually sha(scrypt(email+passphrase))
[ Parent | on HN ]