3 ms·

Why not just have browser support for SRP as a standard type of form request or TLS-SRP? It's fairly well known crypto and doesn't require a 3rd party service

Why not just have browser support for SRP as a standard type of form request or TLS-SRP? It's fairly well known crypto and doesn't require a 3rd party service to be active or access to a smart phone with an active network connection.

jamiesonbecker 13y ago
Good thought. I believe SRP is patent-encumbered.
- gcommer 13y ago
  Actually, it is just the opposite. According to wikipedia, SRP was carefully designed to avoid any current patents, and according to this stanford page[1], it is available commercially and non-commercially under a royalty-free license, along with a BSD-ish-licensed Open Source implementation. [1] http://srp.stanford.edu/whatisit.html http://srp.stanford.edu/whatisit.html
ianburrell 13y ago
SRP doesn't solve the problem with having to remember (or store) good unique passwords for each site. It does help with the authenticating password over insecure connection but SSL solves that for most sites. It doesn't solve the problem of securely storing passwords; the value that is stored can be brute forced to get password and is equivalent to cleartext password for any SRP using site.
- jimktrains2 13y ago
  > It does help with the authenticating password over insecure connection I'm not sure you understand what SRP is; it's built to be used over insecure connections. > It doesn't solve the problem of securely storing passwords; the value that is stored can be brute forced to get password and is equivalent to cleartext password for any SRP using site. I don't think you understand what SRP is; if you could do this, then public key crypto has a much larger problem then passwords and you should be worried about TLS as well.
drdaeman 13y ago
Why not just have browser support for client X.509 certificates? Oh, wait, we have one. It's just that UIs are horrible because noone ever cared about that part (because nobody uses it, because UI is horrible).

jamiesonbecker 13y ago

Good thought. I believe SRP is patent-encumbered.

gcommer 13y ago
Actually, it is just the opposite. According to wikipedia, SRP was carefully designed to avoid any current patents, and according to this stanford page[1], it is available commercially and non-commercially under a royalty-free license, along with a BSD-ish-licensed Open Source implementation. [1] http://srp.stanford.edu/whatisit.html http://srp.stanford.edu/whatisit.html

ianburrell 13y ago

SRP doesn't solve the problem with having to remember (or store) good unique passwords for each site. It does help with the authenticating password over insecure connection but SSL solves that for most sites. It doesn't solve the problem of securely storing passwords; the value that is stored can be brute forced to get password and is equivalent to cleartext password for any SRP using site.

jimktrains2 13y ago
> It does help with the authenticating password over insecure connection I'm not sure you understand what SRP is; it's built to be used over insecure connections. > It doesn't solve the problem of securely storing passwords; the value that is stored can be brute forced to get password and is equivalent to cleartext password for any SRP using site. I don't think you understand what SRP is; if you could do this, then public key crypto has a much larger problem then passwords and you should be worried about TLS as well.

drdaeman 13y ago

Why not just have browser support for client X.509 certificates? Oh, wait, we have one. It's just that UIs are horrible because noone ever cared about that part (because nobody uses it, because UI is horrible).