News for hackers. Stuff that matters.
Re:What Is Secure Remote Password (SRP) Protocol and How to ... by tialaramex on Sunday December 01, 2019 @12:20PM (#21676518)
It isn't used everywhere because it's much too new, nothing like SRP existed when password elements were added to HTML let alone back when the authentication mechanism was added to HTTP itself.

Also none of Tim's toy hypermedia system is built from state of the art components. HTTPS is a retrofit, graphics are an afterthought, the reason Tim succeeded is that since this was not his academic field he felt confident to do a half-arsed job whereas people who'd been doing this for years wanted to actually solve the hard problems first.

Why we didn't suddenly wake up in say 2000 and switch to SRP? Because for every crap site they already had a crap password system, no obvious incentive to get a good one. And as another poster points out this particular PAKE is/was patented which always stifles usage.

There are no comments on this comment yet.