CBCrypt: Encrypt from the client rather than send passwords to servers

Re:CBCrypt: Encrypt from the client rather than send passwor... by Justsignedup on Tuesday October 06, 2015 @04:10PM (#10341960)

While true, the risk of exposure is significantly smaller if the derived key is different for every site.

The algo can work by the site sending the user their personal salt. The algo will then encrypt the password, use the salt, and send the derived key.

This DOES remove the burden on the user of trusting every site with their password. The problem is quickly the password is only but one of a lot of data hackers look for.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by microcolonel on Tuesday October 06, 2015 @04:35PM (#10342163)

That's not necessarily true; If it can generate multiple outputs for the same input, it could mean that the derivation function exposes something about the secret in the degree or nature of the variation.

[ Parent | on HN ]

Re:CBCrypt: Encrypt from the client rather than send passwor... by xorcist on Tuesday October 06, 2015 @05:10PM (#10342428)

It's hard to quantify risk.

Do you rely on the server to play nice, and not present you with fake login boxes, then all bets are off.

[ Parent | on HN ]