4 ms·
The main problem this project is trying to mitigate is the password reuse. If user A uses the same password for a lot of sites, a malicious person B is able to
by ceronman 11y ago
The main problem this project is trying to mitigate is the password reuse. If user A uses the same password for a lot of sites, a malicious person B is able to convince A to join a new service, like a cat photo sharing app or something like that. If A uses his/her same usual password, B automatically gets access to all A's accounts.
The way this project tries to solve the problem is by hashing the password from the client side so that sites never get the real password, but a hash instead. As other commenters have pointed out, this is not entirely effective because the attacker still can crack the hash. It just makes the problem more difficult depending on the size of the original password.
The real solution to this problem is to stop sharing password at all. Use a password manager for that purpose.
- api 11y agoA good hash like scrypt makes the password very, very hard to crack unless it's a very poor password. The real problem with this is that it'd never be feasible to convert enough sites and apps to using it to make it safe to reuse passwords
- Stefan-H 11y agoAs the page points at, the malicious website does not recieve a hash of the password, but rather a public key derivied from the password: "The worst attack a malicious server can mount is an expensive brute force attack, attempting to overpower the rate-limiting function and eventually guess a password that recreates the exposed public key." That is a very different attack to try to pull off.
- amenghra 11y agoPhising sites can bypass this by creating an input field which looks like a password input field but isn't actually one. +1 for password managers or U2F style authentication systems.