Re:XMPP: Admin-in-the-middle
by megous on Thursday November 04, 2021 @08:27AM
(#29106273)
Yes. You'd probably want to derive your private key from the password, so that you don't have to store anything and use this method portably on multiple computers. But there's no need to ever send a password to the server, even when setting/changing it.
In theory... I don't know if there's any established auth method like this, that would eg. generate ed25519 secret key from a password, and used pubkey from it to send to the server when creating account or changing passwords and server using some challenge response, to authenticate users.
In theory... I don't know if there's any established auth method like this, that would eg. generate ed25519 secret key from a password, and used pubkey from it to send to the server when creating account or changing passwords and server using some challenge response, to authenticate users.