Reputation
Top tag
Next privilege 50 Rep.
Comment everywhere
Badges
1
Newest
 Student
Impact
~549 people reached

  • 0 posts edited
  • 0 helpful flags
  • 0 votes cast
Oct
5
comment Secure web user authentication even after server-side database compromise
That's good for banking and corporate environments. Is there no way to provide attack resistance for a typical web application? I understand the security benefits of a private key that's not accessible to Javascript and not ever sent to the server. Is there a middle ground with a (server-generated) user client key that's combined with the server key to generate an HMAC, where the server never persists the user client key (only uses it temporarily for computation when validating the credentials)?