4 ms·
As for the crypto, am I correct in seeing that it uses PBKDF2 to derive an AES key from their password. And then it uses SJCL's encrypt/decrypt methods?
by wybiral 9y ago
As for the crypto, am I correct in seeing that it uses PBKDF2 to derive an AES key from their password. And then it uses SJCL's encrypt/decrypt methods?
- twiss 9y agoYes, that's correct. Unless Web Crypto is available, in which case it uses that.
- mr_toad 9y agoHow does password / key recovery work?
- twiss 9y agoWhen you create an account, it downloads a file which contains - Your username - Your password, encrypted with a random key. That random key (but not your encrypted password) is sent to the server. When you request a password recovery, we send you a file by email which contains that key and with which you can decrypt your password. That way, - We don't have your encrypted password - A random person / application can't grab your password from your computer - We verify that it's you who wants a password recovery (by sending you an email).