3 ms·
One of the major problems is that we're still sending passwords to the server. We need better protocols, like SRP to enable us not to send the server clear-text
by jimktrains2 11y ago
One of the major problems is that we're still sending passwords to the server. We need better protocols, like SRP to enable us not to send the server clear-text passwords. (Yes, I consider it clear-text even over TLS because the server still sees the password in all its glory.)
- StavrosK 11y agoWhen has sending the password to the server over TLS ever cause any breaches? Every breach I know was because data at rest was poorly kept, on either side.
- schrodinger 11y agoHeartbleed
- jimktrains2 11y agoYes, and if the server has access to your clear-text password, it can choose to store it insecurely. Something like SRP enforces that the server store them in a secure manner.