4 ms·

What about Facebook login (or other oauth based systems)? Seems to me this solves most of the problem.

chalst 13y ago
It solves the problem with offline password cracking, but it introduces the need to trust a third party. Since the client side of SRP can be implemented in Javascript [1,2,3], there's not really much in the way of compelling reasons not to use it. [1]: There's a client in the SRP bundle at http://srp.stanford.edu/download.html http://srp.stanford.edu/download.html [2]: https://github.com/symeapp/srp-client https://github.com/symeapp/srp-client [3]: https://github.com/clipperz/javascript-crypto-library https://github.com/clipperz/javascript-crypto-library
- nly 13y ago
  One of the key aspects of SRP is it provides mutual authentication. The server is considered untrusted until authenticated. If you run it in Javascript you lose the benefits it has over simple challenge-response client authentication. TLS-SRP could replace ordinary CA based server authentication, but I think there's a middle ground somewhere. Both are complimentary. CAs should be authenticating servers to my browser, and SRP should be authenticating servers to me.
  - chalst 13y ago
    This isn't quite right: you still keep the benefit that the server in no sense has a copy of your password, and it is publically visible what the program is that implements the client-side authentication. That said, I agree that there are strong benefits to having support for SRP in the browser.
nly 13y ago
Yes, I love trusting the keys to all my accounts to one corporation. Less tongue-in-cheek, would you trust Facebook login for banking?
- esrauch 13y ago
  Well, I do actually think the fb engineers working on login and password security are more competent than the ones that my bank currently has (8 character MAX length....). The only edge that banks have is that they know to scrutinize suspicious logins more heavily, which is something that fb would certainly do if their login was ever used for bank logins.
rmc 13y ago
Until the site that you use for OAuth gets hacked.
- acdha 13y ago
  Security is all about pragmatism: is it more likely that Facebook / Google will be hacked and not deal with it quickly or that users will react to incessant password nagging by using weak ones? When someone's account is compromised, is it better if they have to change one password or hundreds?
aestra 13y ago
No friggin way. I disabled that for a reason. I won't use Facebook login for anything else except Facebook. I don't want my Facebook identity being shared with a third party. Isn't good for the tin foil hats.

It solves the problem with offline password cracking, but it introduces the need to trust a third party. Since the client side of SRP can be implemented in Javascript [1,2,3], there's not really much in the way of compelling reasons not to use it. [1]: There's a client in the SRP bundle at http://srp.stanford.edu/download.html http://srp.stanford.edu/download.html [2]: https://github.com/symeapp/srp-client https://github.com/symeapp/srp-client [3]: https://github.com/clipperz/javascript-crypto-library https://github.com/clipperz/javascript-crypto-library

nly 13y ago
One of the key aspects of SRP is it provides mutual authentication. The server is considered untrusted until authenticated. If you run it in Javascript you lose the benefits it has over simple challenge-response client authentication. TLS-SRP could replace ordinary CA based server authentication, but I think there's a middle ground somewhere. Both are complimentary. CAs should be authenticating servers to my browser, and SRP should be authenticating servers to me.
- chalst 13y ago
  This isn't quite right: you still keep the benefit that the server in no sense has a copy of your password, and it is publically visible what the program is that implements the client-side authentication. That said, I agree that there are strong benefits to having support for SRP in the browser.

nly 13y ago

Yes, I love trusting the keys to all my accounts to one corporation. Less tongue-in-cheek, would you trust Facebook login for banking?

esrauch 13y ago
Well, I do actually think the fb engineers working on login and password security are more competent than the ones that my bank currently has (8 character MAX length....). The only edge that banks have is that they know to scrutinize suspicious logins more heavily, which is something that fb would certainly do if their login was ever used for bank logins.

rmc 13y ago

Until the site that you use for OAuth gets hacked.

acdha 13y ago
Security is all about pragmatism: is it more likely that Facebook / Google will be hacked and not deal with it quickly or that users will react to incessant password nagging by using weak ones? When someone's account is compromised, is it better if they have to change one password or hundreds?

aestra 13y ago

No friggin way. I disabled that for a reason. I won't use Facebook login for anything else except Facebook. I don't want my Facebook identity being shared with a third party. Isn't good for the tin foil hats.