Hacker News Reader

Comment by coherentpony | Hacker News Reader

May I ask a potentially dumb question? Why store my password at all?

To be clear, they aren't storing your password. They are storing an encrypted hash of your password. This is so they can verify your password when you use it. The alternative is to not have passwords in one fashion or another.

How else are they supposed to verify your password when you attempt to log in?

Email a link with token to log in.

That is a good way to get endless token links spammed at your inbox...

Gmail tokens tab.

So all of a sudden the service in question's security is only as strong as the security of the client's email service? Yeah that sounds like a big nope to me.

This 'idea' has been thrashed out a hundred times, even by supposed 'experts' like Egor Homakov who also says things like "You don't need 2FA, it's pointless and annoying for users".

There is something like Secure Remote Password (SRP)[1] where it is possible to verify a password without password being to transmitted to the server at all.

The problem is, it is tricky to implement, a little bit old, and still vulnerable to bruteforce attack (Blizzard uses it, and IIRC their verifier database was leaked once, with g and N being published, so anyone could do dictionary attack on it. I believe Apple is also using it).

[1]: https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

We use SRP with our online accounting software [1]. We counter brute-force attacks by using Scrypt for the work factor, and forcing all login credentials to have a high degree of entropy.

[1] https://www.solaraccounts.co.uk/

They store hashes, not the password. The article makes that pretty clear.

That said, the title could have been chosen more carefully.

I often wonder this as well.

Why can't they store my public key and authenticate me the way Github/Bitbucket/SSH all do?

Reply on news.ycombinator.com