News for hackers. Stuff that matters.

A comment on Notifying administrators about unhashed password storage. Parent comment

Re:Notifying administrators about unhashed password storage by topmonk on Wednesday May 22, 2019 @06:01PM (#19986029)
Yea you're right. But what about this, the client uses the password as a seed to create a public/private key pair, and sends the public key to the server. If it is during password creation, the server stores this public key in relation to the user, otherwise verifies it. Then the server sends a challenge* and the client uses the private key to sign it and return a response.

* actually the server would send the challenge ahead of time along with serving the web page

[ Parent | on HN ]
Re:Notifying administrators about unhashed password storage by eropple on Wednesday May 22, 2019 @07:54PM (#19986905)
That sounds like PAKE. I'm not qualified to opine on that; it's above my pay grade. I can see a lot of implementation issues, though, if you wanted to make it a browser component outside the control of the developer.
[ Parent | on HN ]