26 reputation
bio website
visits member for 1 year, 6 months
seen Apr 9 at 0:19

comment Secure web user authentication even after server-side database compromise
That's good for banking and corporate environments. Is there no way to provide attack resistance for a typical web application? I understand the security benefits of a private key that's not accessible to Javascript and not ever sent to the server. Is there a middle ground with a (server-generated) user client key that's combined with the server key to generate an HMAC, where the server never persists the user client key (only uses it temporarily for computation when validating the credentials)?