4 ms·

Sooo what happens when whiteout gets an NSL and suddenly the "we don't store the keycode on our server.... trust us" mantra gets thrown out the window? Why inve

Sooo what happens when whiteout gets an NSL and suddenly the "we don't store the keycode on our server.... trust us" mantra gets thrown out the window? Why invent your own authentication protocol with AES-256-GCM when this seems like a clear-cut case for TLS? Why use PBKDF2 over Scrypt?

felixhammerl 12y ago
wtf tls? it's not about transport. it's about us not being able to read shit b/c you encrypted your key. i don't want your plaintext keys, so to prevent the nsl thing from happening. also, nsl? we're german. meh. ;) "trust us" sucks. period. we can agree on that. https://blog.whiteout.io/2014/06/12/how-we-operate/ https://blog.whiteout.io/2014/06/12/how-we-operate/ we're trying to move away from storing stuff on our servers. more on that soon. why pbkdf2? here's why: http://www.w3.org/TR/WebCryptoAPI/#pbkdf2 http://www.w3.org/TR/WebCryptoAPI/#pbkdf2