Hacker News Reader

If this is traditional public-key crypto, having the password does nothing for the attacker without the private key. But I didn't watch his "technical details video" so I don't know what he's actually implemented. He mentions that getting the user's password would allow you to derive the private key, which makes no sense.

View on HN

That's exactly the problem. The private key and the password are effectively 1-1. So if you can phish the password, you have the private key. This solves nothing.

I still don't understand the model, then. How the hell do you derive a private key from a password?

Reply on news.ycombinator.com