Hack of Cupid Media dating website exposes 42 million plaintext passwords

Re:Hack of Cupid Media dating website exposes 42 million pla... by nly on Wednesday November 20, 2013 @07:01AM (#6767534)

One of the key aspects of SRP is it provides mutual authentication. The server is considered untrusted until authenticated. If you run it in Javascript you lose the benefits it has over simple challenge-response client authentication.

TLS-SRP could replace ordinary CA based server authentication, but I think there's a middle ground somewhere. Both are complimentary. CAs should be authenticating servers to my browser, and SRP should be authenticating servers to me.

[ Parent | on HN ]

Re:Hack of Cupid Media dating website exposes 42 million pla... by chalst on Wednesday November 20, 2013 @08:51AM (#6767916)

This isn't quite right: you still keep the benefit that the server in no sense has a copy of your password, and it is publically visible what the program is that implements the client-side authentication.

That said, I agree that there are strong benefits to having support for SRP in the browser.

[ Parent | on HN ]