I'm currently using a login system outlined below:

1. String of 1000 characters is generated on the server each time the website is opened and works for maximum of 5 minutes at which point a new string is generated which will be in memory until next login
2. String is then encrypted using my public key which is stored on the server
3. PGP encrypted message is then shown on the login page
4. After I decrypt PGP message using my private key I copy/paste the decrypted message onto the login page
5. and finally server-side script compares the decrypted message to the string generated in step 1 and after login previously generated string is no longer available

Pros of using this system:

• password is only stored in server memory for a very short time
• PGP message can only be decrypted using my private key(RSA - 4096 bits) AND my passphrase

Cons:

• inconvenience
• my implementation might be flawed

This is for educational purposes only, and won't be used on any production system.

What are some of the potential security risks of using such system?

I'm currently using a login system outlined below:

1. String of 1000 characters is generated on the server each time the website is opened and works for maximum of 5 minutes at which point a new string is generated which will be in memory until next login
2. String is then encrypted using my public key which is stored on the server
3. PGP encrypted message is then shown on the login page
4. After I decrypt PGP message using my private key I copy/paste the decrypted message onto the login page
5. and finally server-side script compares the decrypted message to the string generated in step 1 and after login previously generated string is no longer available

Pros of using this system:

• password is only stored in server memory for a very short time
• PGP message can only be decrypted using my private key(RSA - 4096 bits) AND my passphrase

Cons:

• inconvenience
• my implementation might be flawed

This is for educational purposes only, and won't be used on any production system.

I also uploaded the code to github if anyone wants to see the code

What are some of the potential security risks of using such system?

I'm currently using a login system outlined below:

1. String of 1000 characters is generated on the server
2. String is then encrypted using my public key which is stored on the server
3. PGP encrypted message is then shown on the login page
4. After I decrypt PGP message using my private key I copy/paste the decrypted message onto the login page
5. and finally server-side script compares the decrypted message to the string generated earlier

What are some of the potential security risks of using such system?

I'm currently using a login system outlined below:

1. String of 1000 characters is generated on the server each time the website is opened and works for maximum of 5 minutes at which point a new string is generated which will be in memory until next login
2. String is then encrypted using my public key which is stored on the server
3. PGP encrypted message is then shown on the login page
4. After I decrypt PGP message using my private key I copy/paste the decrypted message onto the login page
5. and finally server-side script compares the decrypted message to the string generated in step 1 and after login previously generated string is no longer available

Pros of using this system:

• password is only stored in server memory for a very short time
• PGP message can only be decrypted using my private key(RSA - 4096 bits) AND my passphrase

Cons:

• inconvenience
• my implementation might be flawed

This is for educational purposes only, and won't be used on any production system.

What are some of the potential security risks of using such system?