3 ms·
There is a better way: use an oracle-like device whose secret key is unavailable. See (shameful plug) http://thesybil.net http://thesybil.net Yes, it is acade
by pfortuny 7y ago
There is a better way: use an oracle-like device whose secret key is unavailable.
See (shameful plug) http://thesybil.net http://thesybil.net
Yes, it is academic but it should be everywhere.
I improved it to perform client-side hashing and encryption but have had not the time to update the docs.
- progval 7y agoI can't connect, the domain does not resolve. But sure, there are good solutions to this, like SCRAM. Unfortunately, there is not much point when the authentication code is controlled by the server (eg. JS served by a server)
- pfortuny 7y agoSorry, I always forget the order: http://thesibyl.net http://thesibyl.net