4 ms·
The author suggests that this solves the phishing problem. Is that true, and if so, is that worthwhile? UPDATE: I wonder if the author is wrong about this. If
by raganwald 16y ago
The author suggests that this solves the phishing problem. Is that true, and if so, is that worthwhile?
UPDATE: I wonder if the author is wrong about this. If we start with the presumption that a user is susceptible to phishing, what can be done to prevent them from entering their password into a text field that uses JS to change their characters to little black circles? Now you'd have to create some sort of browser feature like a "key" icon that appears somewhere outside of the page when you are in a "hashed" password box, and you'd have to teach users not to put passwords in a field that doesn't display the key. If you can teach them all that, you can teach them not to be phished.
And oh yes, while you're trying to teach them that, Facebook is busy teaching them to enter their passwords into a plain text box so they can "find their friends."
- tptacek 16y agoIn a perfect world, it would lessen the impact of phishing by disclosing only a crackable password hash to a phisher. In the real world, phishers will just construct phishing sites that appear to use the "secure" password type but actually don't.
- deleted 16y ago[deleted]
- jules 16y agoThen a password UI that can't be forged could be used, but I agree if you're going to do it, do it right.
- tptacek 16y agoHave you considered how hard it would be to create a password FORM input that couldn't be forged?
- goran 16y agoSo....let's just discard with web security altogether.
- tptacek 16y agoHard problems don't become more tractable just because you get angry at them.
- metageek 16y agoHow about this: if focus is in a password field, then you get a visual signal somewhere in the chrome--e.g., the color of the location bar changes. Something that HTML+JS just can't do.
- tptacek 16y agoWe can't train users to look for a lock icon to see if they're SSL encrypted, so I'm not optimistic that something as subtle as a URL bar change is going to guide them to secure password inputs.
- sidek 16y agoConsider this, then: a secure password box is put at the very very bottom of the page in an obscure location. JS is used to make a fake one that is prominent. How will you deal with that?
- jules 16y agoYes: trivial. Have the user type in an area outside the page.
- deleted 16y ago[deleted]
- tptacek 16y agoOur failure to connect on this point seems to be getting militant. I'm not suggesting that nothing should be done to solve the plaintext password problem. I'm suggesting that your proposed solution does very little to address the incident that motivated you to post it (the Gawker compromise). Instead of advocating for your solution, I'm encouraging you to advocate for a much, much better solution. The only downside I can see to my suggestion over your suggestion, apart from the fact that it requires approximately 50 lines more code, is that you didn't come up with it.
- deleted 16y ago[deleted]
- tptacek 16y agoAre we looking at different RFC 5054's? I got mine off Trevor Perrin's site, and it specifies SRP, not SHA1. My point is SRP; it's not the specific RFC number. SRP is not "SHA1, no less".