4 ms·
I like this idea. You could implement the same password hashing algorithm on the router and in javascript and just transmit the hash.
by jacob019 6y ago
I like this idea. You could implement the same password hashing algorithm on the router and in javascript and just transmit the hash.
- vbezhenar 6y agoSomeone intercepts that hash and replay it to gain access to the router. You can’t solve that problem without trusted CA.
- jacob019 6y agoWell you could implement public key authentication in javascript with a password derived public key. But someone could still intercept your session cookie. You could take it even further and build out an encrypted channel, websocket, or just message based, to send all the data over and use client side rendering. Probably too complicated, but if implemented properly, it would work.
- cesarb 6y agoNo matter how complicated you make it, a man-in-the-middle pretending to be the device can simply replace your authentication JavaScript. The only way to stop an active attacker from doing that is to authenticate the device to the browser, and this cannot be done in unauthenticated JavaScript sent from the device.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]