26 reputation
1
bio website
location
age
visits member for 1 year, 10 months
seen Jun 12 at 22:12

Oct
5
comment Secure web user authentication even after server-side database compromise
That's good for banking and corporate environments. Is there no way to provide attack resistance for a typical web application? I understand the security benefits of a private key that's not accessible to Javascript and not ever sent to the server. Is there a middle ground with a (server-generated) user client key that's combined with the server key to generate an HMAC, where the server never persists the user client key (only uses it temporarily for computation when validating the credentials)?
Oct
5
awarded  Student
Oct
5
asked Secure web user authentication even after server-side database compromise