3 ms·
In that case you can't just store the hash of the password, you will need to password itself.
by joopxiv 11y ago
In that case you can't just store the hash of the password, you will need to password itself.
- kuschku 11y agoHmm. Yeah. I’ve thought about it for the last few hours, and decided that the best solution is to just use RSA in client.
- joopxiv 11y agoHow would that work? If you would use a private key to authenticate to the server you would still need to protect this key with a password. Otherwise stealing the private key will get an attacker access to the server just as simple.
- kuschku 11y agoWell, you’d be 100% safe of MitM. And you could use a hardware key auth. Like the German eID, where the key is signed by the government and on a special chipcard. The software requests the card to sign, you need to type in your PIN on the reader itself, and the request will be signed with RSA. The public key is world-readable on the card, so you can just send that to the server.