3 ms·
These challenge response mechanisms still require a shared secret. This means the server still needs to know either your password or a hashed version of it. TLS
by rocqua 9y ago
These challenge response mechanisms still require a shared secret. This means the server still needs to know either your password or a hashed version of it.
TLS covers the problems a challenge-response method is supposed to solve. That is, TLS prevents replay attacks because the shared secret is sent under encryption.
Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with a server-provided salt.
- wyldfire 9y ago> This means the server still needs to know either your password or a hashed version of it. Yes, the latter, please.
- MarkMc 9y ago> Really, the solution to exposing passwords to the endpoint is to do key-derivation client-side, with a server-provided salt. That sounds a lot like Secure Remote Password protocol: https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...