3 ms·
Open truefactor:// app. Currently there is only a Web version and it has serious downsides (web crypto is a bad idea), but think of it as a Light version. Deskt
by homakov 11y ago
Open truefactor:// app. Currently there is only a Web version and it has serious downsides (web crypto is a bad idea), but think of it as a Light version. Desktop apps to come later.
- valarauca1 11y agoI was looking for more of a write up. I'm just wondering how/where the credentials get cached and how you securely know the user re-connecting is the user who previously disconnected.
- homakov 11y agoCredentials are encrypted with passphrase and seamlessly stored on the server by token=sha256(passphrase). https://truefactor.io/ https://truefactor.io/
- valarauca1 11y agoSite gives me a login page. I make a login and I get no information about the service just user options. Also where is the salt stored? SHA256 is pretty easy to brute force even salted.
- homakov 11y agoEmail itself is salt (or rather public part of passphrase). So from email+passphrase encryptionKey is derived using scrypt. So it's actually sha(scrypt(email+passphrase))