3 ms·
> using a password necessarily entails revealing the password Not always - the Secure Remote Password protocol doesn’t reveal the password to the server: http:
by MarkMc 13y ago
> using a password necessarily entails revealing the password
Not always - the Secure Remote Password protocol doesn’t reveal the password to the server: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
- lisper 13y agoYeah, but no browsers implement SRP (AFAICT) so this is a moot point. In today's world, using a password on the web means typing that password into a web form, at which point all bets are off: you have no control, or even knowledge, of how that password is processed from that point on. The only thing you can be even slightly confident of is that if you're typing the password into an HTTPS page then you're somewhat safe against MITM attacks. But there's no way to protect yourself against the incompetence (or maliciousness) of whoever you're doing business with.