4 ms·

I don't think it's stored in plain text, the post was about standard login/password signing in instead of too-complex current mechanism.

by k_bx 13y ago

blueskin_ 13y ago
If it's a username/password pair, either the data has to be stored in plaintext, or with a key escrowed using the user password, which are not as secure as a private key only known to the user.
- icebraining 13y ago
  No, you can use a different system: don't send the password to the server, instead create a private/public key pair from the password (deterministically) and send only the public key to the server. When you want to authenticate, just have the client sign something with the private key. If you want to encrypt on the client, it can just do PGP-like encryption (encrypt data with random AES key, encrypt that key with public key, send all to the server).
  - blueskin_ 13y ago
    Considering the average user's password choice tendencies, that's still weaker than a key from a proper source of entropy, then password reuse on top of that. That plus IIRC, RSA isn't deterministic even with the same seed. Not sure about generators for elliptic curve though.
    - icebraining 13y ago
      I think it is, at least that's what Cryptico[1] does, if I understand it correctly. [1] https://github.com/wwwtyro/cryptico https://github.com/wwwtyro/cryptico
    - tga_d 13y ago
      They're using key-stretching to mitigate the use of bad passphrases, though reuse will still be an issue. https://wiki.mozilla.org/Identity/AttachedServices/KeyServerProtocol#Client-Side_Key_Stretching https://wiki.mozilla.org/Identity/AttachedServices/KeyServer... And RSA is deterministic.
- tga_d 13y ago
  Not true, there are plenty of key-derivation schemes. Basic idea for how one may work (not necessarily the one they will use, I'm still reading the wiki pages): data is encrypted locally with a hash of the user's passphrase, then that hash is hashed again and sent to the server as a login credential. The server never sees the original passphrase, nor the encryption key, nor the contents of the material uploaded.
tga_d 13y ago
Historically, all data was encrypted locally before being sent to the other device. Now, by default, some data will be local-only encrypted, and some won't (the motivation being recovery services). There are plans though to have an option to locally encrypt all data. https://wiki.mozilla.org/Identity/AttachedServices/Architecture#Data_Security https://wiki.mozilla.org/Identity/AttachedServices/Architect...

I don't think it's stored in plain text, the post was about standard login/password signing in instead of too-complex current mechanism.

by k_bx 13y ago

I don't think it's stored in plain text, the post was about standard login/password signing in instead of too-complex current mechanism.

blueskin_ 13y ago

If it's a username/password pair, either the data has to be stored in plaintext, or with a key escrowed using the user password, which are not as secure as a private key only known to the user.

icebraining 13y ago
No, you can use a different system: don't send the password to the server, instead create a private/public key pair from the password (deterministically) and send only the public key to the server. When you want to authenticate, just have the client sign something with the private key. If you want to encrypt on the client, it can just do PGP-like encryption (encrypt data with random AES key, encrypt that key with public key, send all to the server).
- blueskin_ 13y ago
  Considering the average user's password choice tendencies, that's still weaker than a key from a proper source of entropy, then password reuse on top of that. That plus IIRC, RSA isn't deterministic even with the same seed. Not sure about generators for elliptic curve though.
  - icebraining 13y ago
    I think it is, at least that's what Cryptico[1] does, if I understand it correctly. [1] https://github.com/wwwtyro/cryptico https://github.com/wwwtyro/cryptico
  - tga_d 13y ago
    They're using key-stretching to mitigate the use of bad passphrases, though reuse will still be an issue. https://wiki.mozilla.org/Identity/AttachedServices/KeyServerProtocol#Client-Side_Key_Stretching https://wiki.mozilla.org/Identity/AttachedServices/KeyServer... And RSA is deterministic.
tga_d 13y ago
Not true, there are plenty of key-derivation schemes. Basic idea for how one may work (not necessarily the one they will use, I'm still reading the wiki pages): data is encrypted locally with a hash of the user's passphrase, then that hash is hashed again and sent to the server as a login credential. The server never sees the original passphrase, nor the encryption key, nor the contents of the material uploaded.

tga_d 13y ago

Historically, all data was encrypted locally before being sent to the other device. Now, by default, some data will be local-only encrypted, and some won't (the motivation being recovery services). There are plans though to have an option to locally encrypt all data. https://wiki.mozilla.org/Identity/AttachedServices/Architecture#Data_Security https://wiki.mozilla.org/Identity/AttachedServices/Architect...