Some problems with SQRL

Posted by RickHull on Wednesday October 09, 2013 @04:25AM
from the grymoire.wordpress.com dept.

http://grymoire.wordpress.com/2013/10/09/the-problem-with-sqrl/

( 5 comments | 7 points | on HN )

Re:Some problems with SQRL by cvrajeesh on Wednesday October 09, 2013 @06:29AM (#6520396)

I don't agree with his point "SQRL:// is a bad idea" because custom scheme is only for launching the SQRL app nothing else and the data that is passed through URL will be a random value

[ Parent | on HN ]

Re:Some problems with SQRL by khulat on Wednesday October 09, 2013 @02:18PM (#6522863)

I think that basically all concerns that are raised are invalid, because the person who posted them doesn't understand how SQRL works.

See https://www.grc.com/sqrl/sqrl.htm for an explanation, which differs drastically from everything that is described in the post.

[ Parent | on HN ]

Re:Some problems with SQRL by mtp0101 on Wednesday October 09, 2013 @06:11AM (#6520351)

There's a bit where he implies that if an encryption process doesn't take very long to execute on a smartphone, then it must be easy to crack the resulting file on a powerful server. Am I making a mistake here?

[ Parent | on HN ]

Re:Some problems with SQRL by willvarfar on Wednesday October 09, 2013 @06:44AM (#6520438)

Yes, its confused.

Scrypt can be held up as a very good choice for key stretching.

[ Parent | on HN ]

Re:Some problems with SQRL by savszymura on Wednesday October 09, 2013 @05:42AM (#6520274)

I hope these concerns were contributed to GRC's newsgroups.

[ Parent | on HN ]