3 ms·
> Since there's a central server involved in this authentication According to a comment above, it's possible to use teamviewer purely locally, without a centra
by Thorrez 7y ago
> Since there's a central server involved in this authentication
According to a comment above, it's possible to use teamviewer purely locally, without a central server.
- marcus_holmes 7y agoHow does TV authenticate a login locally if disconnected from the server? I mean, in an ideal world where they didn't save the user's password locally...
- Thorrez 7y agoAre you asking how they currently do it, or how it could theoretically be done better? If you're asking how they currently do it, I guess by sending the password, but I don't really know. One way that would be slightly better than that would be to send the hash. That's still a replayable token, but it has the advantage that if someone does password reuse it's not immediately replayable against other websites. Ideally the hash would be salted (maybe with the username and some teamviewer-specific constant). Even better than sending it would be to use a PAKE, authenticated with that salted hash. Maybe an alternative would be some sort of asymmetric key system, where each device gets its own keypair. I guess it depends on exactly what functionality is needed. Does it need to be able to be setup offline, or can it be setup online, then go offline for further use?
- marcus_holmes 7y agoYeah I guess the first. I suppose they could insist on an online login before they allow an offline login, then save the hash locally. A bad person would need to generate a hash collision to login then.