3 ms·
It's not only E2EE. Let's say you would rather not know your users passwords (which I think it commonly agreed upon good security hygiene, at least for storage,
by forty 3y ago
It's not only E2EE. Let's say you would rather not know your users passwords (which I think it commonly agreed upon good security hygiene, at least for storage, but it makes sense that you wouldn't want to have them at all on your servers). You are going to hash it client side with some password hash or even better using some aPAKE. Great, except it's all moot since your password handling code comes from your compromised server. I wish there were practical solutions to this problem.
- boomlinde 3y agoMutual authentication without sharing secrets is already supported at a protocol level in some sense, via client certificates. The relatively straight forward and intuitive nature of password authentication might explain why it hasn't caught on as a replacement.