3 ms·

I'm intrigued, do you have more on the subject that you've written that you can link to or articles you'd recommend?

• bawolff 5y ago
  There's various protocols involving digital signatures or more rarely, zero knowledge proofs where the verifier not only does not know the password but the prover also does not have to reveal it so evesdroppers can't steal it. This contrasts to the more common method of storing a hashed password (e.g. with argon2 or bcrypt) where the server doesn't store the real password, but still stores something that might be bruteforcible and the users still have to provide the real password to log in. In addition to webAuthn (aka fido keys), other common examples are ssh and mutual tls (aka client certificates). SRP is another protocol that does this sort of thing. Some links: https://en.m.wikipedia.org/wiki/Proof_of_knowledge https://en.m.wikipedia.org/wiki/Proof_of_knowledge https://en.m.wikipedia.org/wiki/Digital_signature https://en.m.wikipedia.org/wiki/Digital_signature https://en.m.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...