Hacker News new | past | comments | ask | show | jobs | submit login

One of the key aspects of SRP is it provides mutual authentication. The server is considered untrusted until authenticated. If you run it in Javascript you lose the benefits it has over simple challenge-response client authentication.

TLS-SRP could replace ordinary CA based server authentication, but I think there's a middle ground somewhere. Both are complimentary. CAs should be authenticating servers to my browser, and SRP should be authenticating servers to me.




This isn't quite right: you still keep the benefit that the server in no sense has a copy of your password, and it is publically visible what the program is that implements the client-side authentication.

That said, I agree that there are strong benefits to having support for SRP in the browser.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: