network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 7 months |
| seen | May 20 at 23:19 | |
| stats | profile views | 1 |
|
Oct 5 |
comment |
Secure web user authentication even after server-side database compromise That's good for banking and corporate environments. Is there no way to provide attack resistance for a typical web application? I understand the security benefits of a private key that's not accessible to Javascript and not ever sent to the server. Is there a middle ground with a (server-generated) user client key that's combined with the server key to generate an HMAC, where the server never persists the user client key (only uses it temporarily for computation when validating the credentials)? |
|
Oct 5 |
awarded | Student |
|
Oct 5 |
asked | Secure web user authentication even after server-side database compromise |
