Show HN: Evilpass – A slightly evil password strength checker

Re:Show HN: Evilpass – A slightly evil password strength che... by drdaeman on Saturday February 18, 2017 @02:09PM (#13676136)

The foundation is solid. The UI is terrible and browser vendors don't do anything about it (sort of catch-22 here)

A sane certificate management UI (not hidden beneath 5+ clicks, and not full of useless distractions like "software security token" that scare users away), key escrow protocol (opt-in), transparent certificate sync (yes, has downsides, but no worse than password sync), and some JS APIs to manage certs - that can do miracles. But that won't happen.

[ Parent | on HN ]

Re:Show HN: Evilpass – A slightly evil password strength che... by homakov on Saturday February 18, 2017 @03:25PM (#13676501)

That will happen - truefactor.io

[ Parent | on HN ]

Re:Show HN: Evilpass – A slightly evil password strength che... by drdaeman on Saturday February 18, 2017 @06:00PM (#13677184)

Sorry, this doesn't look attractive to me. Among the downsides I see, the important one is that it requires a whole new software stack. That had been tried many times - I'm afraid, unless you have some really huge corporation backing the project (one that can really push it), it just won't fly.

What's good about TLS is that it's ubiquitous and you don't need anything special to deploy it. Got nginx, Apache or Caddy? Add a single directive (e.g. ssl_verify_client for nginx) and you're almost there, all the validation is already implemented, just tie the keys to your accounts system.

[ Parent | on HN ]

Re:Show HN: Evilpass – A slightly evil password strength che... by homakov on Sunday February 19, 2017 @12:41AM (#13678354)

That software stack is made to fix previous problems. Backed up as a password, deterministic and scales easily.

It is new (tiny and well thought through) API but nobody used client certs anyway, as we found out in this very thread.

[ Parent | on HN ]