Tag Info

New answers tagged

0

All three of the other answers will allow a user to log in without the server owner being able to see the password. However, they're not really providing any authentication. Authentication is the confirmation that it really is you accessing your own account. In this scenario, we're assuming that the server admin has full access to the DB (and that'll ...


1

Any solution is going to involve some public key cryptography. Each user can have a key pair. The secret key could be encrypted with a password as suggested by @Mark. If it is for some reason not practical to store a private key, and the user must be able to log in using just the software and a password, the private key can be generated on the fly. You can ...


2

Use certificates. That way the client never shares it's private key with anyone including the server. The server just has the clients public key which isn't secret. Alternatively run a federated identity solution or leverage one such as Google or Facebook's. There are open source options for this (such as http://en.m.wikipedia.org/wiki/OpenAM ) You also ...


2

It sounds like you want public-key cryptography similar to what SSH supports. The basic idea is that the user provides their public key to the server during the account creation process, then proves their ownership of the corresponding private key during the login process. The public key, as the name implies, isn't even remotely secret, so it meets ...



Top 50 recent answers are included