3 ms·
Store it encrypted on their computer then decrypt it each time it's sent to you? Maybe I'm missing the problem. One way or another you're going to have to hold
by Herring 18y ago
Store it encrypted on their computer then decrypt it each time it's sent to you? Maybe I'm missing the problem.
One way or another you're going to have to hold it as plaintext to submit it to the other site. It's nice to hold it only in RAM, but the vulnerability is always there.
- bbb 18y agoExactly, and use public key crypto: 1) Generate public/private key pair for user. 2) Send public key to client. 3) Encrypt PW on client, store as cookie. 4) Store (user, private key) on your server. 5) Client now sends the encrypted PW whenever it is needed. 6) Server decrypts on demand, but does not store a local copy. Since you never relinquish the private key this is pretty much unbreakable for spyware going through a client's cookies. (Nevermind key loggers...)