Opaque: Passwords Never Leave Your Device

Re:Opaque: Passwords Never Leave Your Device by seaty6 on Tuesday December 08, 2020 @06:31PM (#25353070)

Some services like MEGA and LastPass will encrypt your data with your password to assure you that they can't read it even if they tried. However, this results in the inability to reset your password- if you go to MEGA and try resetting your password (and have no other authenticated instances) you'll lose all your data.

Wouldn't using a PAKE remove the ability to encrypt data with a password, because it is never being sent over cleartext? Also, wouldn't that mean you could no longer be sure that your data wasn't being viewed by the service?

[ Parent | on HN ]

Re:Opaque: Passwords Never Leave Your Device by alan on Tuesday December 08, 2020 @07:58PM (#25353928)

I think the server would be able to encrypt with the user's public key, that way they wouldn't be able to read it. They'd have to send the encrypted data to the client to be decrypted with the private key there

[ Parent | on HN ]