News for hackers. Stuff that matters.

A comment on CBCrypt: Encrypt from the client rather than send passwords to servers. Parent comment

Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:31PM (#10340084)
Credentials are encrypted with passphrase and seamlessly stored on the server by token=sha256(passphrase). https://truefactor.io/
[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by valarauca1 on Tuesday October 06, 2015 @12:38PM (#10340137)
Site gives me a login page. I make a login and I get no information about the service just user options.

Also where is the salt stored? SHA256 is pretty easy to brute force even salted.

[ Parent | on HN ]
Re:CBCrypt: Encrypt from the client rather than send passwor... by homakov on Tuesday October 06, 2015 @12:42PM (#10340171)
Email itself is salt (or rather public part of passphrase). So from email+passphrase encryptionKey is derived using scrypt. So it's actually sha(scrypt(email+passphrase))
[ Parent | on HN ]