Re:Robinhood Stored Passwords in Plaintext
by jsw on Wednesday July 24, 2019 @06:36PM
(#20520711)
The AWS Cognito User Pool Authentication Flow utilizes an augmented PAKE (SRP). I imagine there are a number of major sites that use Cognito along with the SRP auth flows baked into their std libs. I know I've used it a number of times.
[ Parent
| on HN ]
Re:Robinhood Stored Passwords in Plaintext
by sroussey on Thursday July 25, 2019 @01:41AM
(#20522861)
I implemented SRP a decade ago — it has issues, and thus a lot of revisions. It also leaks your salt and you can’t use a pepper. There is Opaque (see the play on PAKE! but it’s new and difficult to search for).