Hacker News new | past | comments | ask | show | jobs | submit login

There's Secure Remote Password, which stores a non-reversible verifier instead: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

Apparently it's quite tricky to implement properly though.




Cryptographic hashes are "non-reversible" too. But they're both vulnerable to offline dictionary attacks if the attacker obtains the host's secrets -- which I think is what `astroduck' was really asking about, leaked server databases like this news story.

(I don't see how there's any possible protocol that behaves otherwise: if Alice is capable of proving she possesses a secret to Bob through a protocol, then Bob can always discover Alice's secret by playing that protocol with himself, enumerating every possible secret until the protocol succeeds. And so can anyone who knows everything that Bob knows about Alice's secret.)

The SRP paper doesn't say much about this except that brute-force dictionary attacks are "expensive". I don't think they make specific claims about computational hardness like scrypt. The paper was written in 1997.

"An attacker who captures the host's password file cannot directly compromise user-to-host authentication and gain access to the host without an expensive dictionary search."

http://srp.stanford.edu/ndss.html


It's also quite tricky to explain to your investors and your customers that your password database was stolen.

Maybe some day there will be "Security as a Service" where someone helps you do this properly.


I believe @tptacek will gladly accept your money for this service. As will Cigital.


"Security as a Service" that does what? Teaches you how to store data securely, explain to investors that user data was stolen or an outsourced password verification utility.

The first can be done if people would bother to learn and completely understand what they're doing (this thread and the corrections I've had to make seems to prove that people think they know what they're doing when they don't).

The second, have fun with.

The third is already solved. oAuth, OpenID, Facebook Connect, Twitter, BrowserID, etc.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: