Comment

Comment by oconnore

No, it would be much better to use a zero knowledge proof (typically called a PAKE — password authenticated key agreement) to demonstrate that the user knows their password without sending that password over the channel.

Sending the password over HTTPS doesn’t expose the password to passive observers, but it does unnecessarily expose the password to the server.

https://en.m.wikipedia.org/wiki/Password-authenticated_key_a...

parent oconnore 4 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton