3 ms·
Do you know of any systems that actually do this? It's the first I've heard of this technique.
by lbotos 8y ago
Do you know of any systems that actually do this? It's the first I've heard of this technique.
- zrm 8y agoNothing should be doing this. Insecure legacy systems that wrongfully expect to see the plaintext of the user's password should be replaced with properly functioning ones. But just because they haven't been yet is no excuse to actually give them the plaintext of the user's password.
- A2017U1 8y agoIt's a pointless technique as noted by others. Along the same lines though is OPAQUE PAKE, where the server doesn't need to store a password hash, only a salt, making server compromise far less dangerous, it's quite elegant. There's no implementations so far I believe. https://eprint.iacr.org/2018/163 https://eprint.iacr.org/2018/163