4 ms·
If you hash the password on the client, then the hash essentially becomes the new password and you haven't solved anything. What you're looking for is a passwor
by fortenforge 7y ago
If you hash the password on the client, then the hash essentially becomes the new password and you haven't solved anything. What you're looking for is a password authenticated key agreement in which one party authenticates to another without an eavesdropper learning any secret [1]. For whatever reason, no major websites use PAKEs today.
[1] https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/ https://blog.cryptographyengineering.com/2018/10/19/lets-tal...
- gdhbcc 7y agoBut you have. It means even if you refuse your passwords elsewhere, only the website that was compromised is compromised.
- mnem 7y agoI agree that it becomes the new password, but it prevents your own site becoming a contributor to credential stuffing attacks - if you don’t have the clear password transmitted to your systems, you can’t leak it accidentally in logs or through poor DB practices. I wonder why PAKEs haven’t caught on?
- ynniv 7y agoAnything faster than bcrypt is practically clear text due to brute forcing, and running bcrypt inside the user interface is needlessly expensive. The common practice is to ensure that passwords are checked and discarded before they can be accidentally disclosed, or to avoid re-usable passwords altogether. Production logs should also only be accessible when there is a direct need. Sometimes this still fails, but it is relatively rare in well run sites.
- jsw 7y agoThe AWS Cognito User Pool Authentication Flow utilizes an augmented PAKE (SRP). I imagine there are a number of major sites that use Cognito along with the SRP auth flows baked into their std libs. I know I've used it a number of times.
- sroussey 7y agoI implemented SRP a decade ago — it has issues, and thus a lot of revisions. It also leaks your salt and you can’t use a pepper. There is Opaque (see the play on PAKE! but it’s new and difficult to search for).
- mehrdadn 7y agoI don't know PAKE to know if this is equivalent to it, but you can use a timestamp + hash to avoid sending anything equivalent to a password. The caveat is your system needs to have the correct time set. But otherwise it works fine.
- Someone1234 7y agoBlizzard Entertainment uses a PAKE implementation (SRP). This article (somewhat ironically) talks about it: https://arstechnica.com/information-technology/2012/08/hacked-blizzard-passwords-not-hard-to-crack/ https://arstechnica.com/information-technology/2012/08/hacke...