Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This keeps you from ever sending the password to the site (similar to e.g. SRP).

Most sites already don't store the password. If you have a sufficiently strong password (i.e. very long, randomly generated, stored in a password manager), it is likely not computationally easier to recover the password from a hash than it is from a public-key. The only improvement here is that you don't have to trust that the site is following best-practices for storing passwords, as you never send them the password.

[edit]

It also prevents phishing attacks for those using some form of entering a password other than autofill from the password-manager.



Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: