vikstrous4

When cracking passwords attackers don't just use brute force. The most effective attacks are ones that exploit human patterns such as leet replacements, capital first letter, punctuation at the end, etc. Concatenated words in all lowercase with no spaces is another pattern that can easily be added to their list and probably already is there, so yes, you can assume that that they will be looking at the space of 2048^4 such passwords.

nowjs has no concept of security.

It's not possible. What's possible is using a browser extension to verify some of the essential javascript and use that javascript to do further verification.

What I meant by that is that a brute force offline attack will always succeed if your password is easily guessable regardless of what hashing or password verification protocols are used.

I also have doubts about the effectiveness of their security, so I'd like to challenge that part of the statement too.

I know these guys have good intentions, but they seem confused about the guarantees that SRP provides. It does allow the server to verify the user's password without receiving it, but it doesn't help in any was against offline attacks. If the "password" (in this case verifier) database is compromised, the attackers will still be able to brute force the passwords. If they implemented it correctly, they will be salted, but this only makes the attack slower. Furthermore, nothing can protect you if your password is password.

Also, I hope that they don't think this removes the need for SSL. It does not. In a web application the server sends the client the javascript to run. A man in the middle can modify it and defeat the whole point of SRP.

> Download the nginx secure key to verify the package

>

>cd /tmp/

>wget http://nginx.org/keys/nginx_signing.key

Verify a package with a key you got over http? Am I the only one who noticed this?