3 ms·
systems should probably not let users pick their passwords. That is they get to pick a generated password (by the system) It implies that the system knows plai
by gluczywo 10y ago
systems should probably not let users pick their passwords.
That is they get to pick a generated password (by the system)
It implies that the system knows plaintext password. Even if the system deletes the password and keeps a hash, it remains the problem of distributing that password to the client in a secure way.
- nickodell 10y agoMost services don't hash the password before sending it to the service, so it's going to pass through the service at some point.
- gluczywo 10y agoYou are right. The second point remains valid though.
- andreareina 10y agoIf the client can securely transmit the password to the system for verification, the system can securely transmit it to the user in the first place.
- drdaeman 10y agoAbsolute majority of systems know the plaintext password on sign-up and subsequent logins. Don't think SRP or any similar protocols are any common.
- nmat 10y ago>It implies that the system knows plaintext password No it doesn't, the password can be generated client side. I know that client side code is not safe, but the purpose here is to protect people who are not tech savvy enough to figure that out.
- remus 10y agoDepends on the system. If it's a website of some description you could always generate the password in the clients browser. Obviously you'd then need to be pretty careful to generate your suggested passwords in a secure way, because any attacker would have visibility of your password generating system.
- hueving 10y ago>it remains the problem of distributing that password to the client in a secure way. That's no different. It uses the same channel the user would send the password to it.
- gluczywo 10y agoWith the difference that when user types the password it is not displayed on the screen. Server-side generated password must be somehow presented to the user.