3 ms·

I know you say you're not storing the password on your end, but what prevents you (or a hacker who somehow gets access to your server) to suddenly start logging

I know you say you're not storing the password on your end, but what prevents you (or a hacker who somehow gets access to your server) to suddenly start logging the passwords as they're sent to the server when someone logs in? You've got what looks like a good approach to storing things in an encrypted way, but it's still requiring the user to trust that the server is actually doing what it says it's doing and no more.

bennyg 13y ago
To be honest, I'm not sure yet. There are a couple things to figure out: - How to make sure the entire process is more transparent, beyond hosting the code on Github right now. Basically, how do I prove that that is the version that's in production in a simple manner without compromising the server as well? - Is there any way to make sure that passwords and usernames aren't logged in between the security layers so even if I were to upload malicious code (I won't), that I'm out of the equation and people can still verify this? Right now, this is just my MVP, and I'm releasing beta codes to make sure the server doesn't crash and that I don't get charged through the roof by Heroku before I have enough moolah to support this side project. I was hoping for a little community input on ways to verify these things. Thanks for the criticism man, it's definitely warranted.
- lmm 13y ago
  I think the only way would be to make a browser extension available for those who care enough to use. Fundamentally, anything on a web page belongs to the server that sent that web page, and if that server is compromised so is the browser window.
- killerpopiller 13y ago
  maybe I can help with hosting your mvp in germany. No NSL is accepted here and I have one or two ideas how to show the server side's integrity status. PM me reddit:3f3nd1
vinceleo 13y ago
I liked the idea without passwords https://news.ycombinator.com/item?id=6330994 https://news.ycombinator.com/item?id=6330994

bennyg 13y ago

To be honest, I'm not sure yet. There are a couple things to figure out: - How to make sure the entire process is more transparent, beyond hosting the code on Github right now. Basically, how do I prove that that is the version that's in production in a simple manner without compromising the server as well? - Is there any way to make sure that passwords and usernames aren't logged in between the security layers so even if I were to upload malicious code (I won't), that I'm out of the equation and people can still verify this? Right now, this is just my MVP, and I'm releasing beta codes to make sure the server doesn't crash and that I don't get charged through the roof by Heroku before I have enough moolah to support this side project. I was hoping for a little community input on ways to verify these things. Thanks for the criticism man, it's definitely warranted.

lmm 13y ago
I think the only way would be to make a browser extension available for those who care enough to use. Fundamentally, anything on a web page belongs to the server that sent that web page, and if that server is compromised so is the browser window.
killerpopiller 13y ago
maybe I can help with hosting your mvp in germany. No NSL is accepted here and I have one or two ideas how to show the server side's integrity status. PM me reddit:3f3nd1

vinceleo 13y ago

I liked the idea without passwords https://news.ycombinator.com/item?id=6330994 https://news.ycombinator.com/item?id=6330994