4 ms·
Specifically, to deliver the Javascript in the first place.
by sarciszewski 11y ago
Specifically, to deliver the Javascript in the first place.
- tptacek 11y agoNo, I mean, you have to trust it to store password hashes, just like in any other scheme. The ECDH public key is generated deterministically from the password. If you have it, you can crack it to recover the password.
- sgk284 11y agoHis underlying assumption is that given an ECDH public-key it is computationally infeasible to derive the private key / seed that went into creating it (via brute force). I suppose that's a fair assumption if your password has high enough entropy or is stretched sufficiently?
- tptacek 11y agoNo. The security of the password storage in this system has nothing to do with that of ECDH.
- sarciszewski 11y agoThis sounds worse than I imagined when I was reading through it earlier. Sorry if I muddied the waters earlier.