C
Cossack Labs Blog
cossacklabs.com · Company blog · on HN since 2015
Cossack Labs, a data security company, writes about cryptography, database protection, zero-knowledge protocols, and mobile and Go security.
What HN saysCommenters link it for zero-knowledge comparison protocols, searchable encryption in its Acra product, and a secure comparator whitepaper.
17HN people shared it
3linked it in comments
39stories submitted
544story points
1 year agolast shared
2015people per year2026
Most-shared posts
- 1Crypto in iOS: Choose your destiny (Infographic)3 people · 8 points · first shared 2016 · discussion on HN
- 2Show HN: Acra, new database protection suite for PostgreSQL2 people · 10 points · first shared 2017 · 3 comments on HN
- 3Crypto wallet security as seen by security engineers1 people · 175 points · first shared 2021 · 102 comments on HN
- 4Zero Knowledge Protocols without Magic1 people · 65 points · first shared 2016 · 19 comments on HN
- 5Cryptographic failures in RF encryption allow stealing robotic devices1 people · 63 points · first shared 2022 · 17 comments on HN
- 6Auditable Macros in C Code1 people · 55 points · first shared 2017 · 12 comments on HN
- 7Techniques for investigating untypical Go memory leaks1 people · 27 points · first shared 2017 · 9 comments on HN
- 8Introducing WebThemis: modern cryptography for Google Chrome web apps1 people · 24 points · first shared 2016 · 1 comments on HN
- 9Preventing SQL Injections When WAF’s Not Enough1 people · 18 points · first shared 2019 · 13 comments on HN
- 10Zero Knowledge Authentication Protocol Secure Comparator1 people · 10 points · first shared 2015 · 1 comments on HN
- 11Nuances of Replacing OpenSSL with Google's BoringSSL1 people · 10 points · first shared 2017 · 2 comments on HN
- 12Themis crypto library adds Rust support in 0.111 people · 9 points · first shared 2019 · discussion on HN
- 13What do we really need to encrypt? Cheatsheet1 people · 7 points · first shared 2018 · discussion on HN
- 14Why making Internet safe is everyone’s responsibility1 people · 6 points · first shared 2016 · discussion on HN
- 15You should avoid SSL for your applications1 people · 6 points · first shared 2015 · 5 comments on HN
What HN people wrote when they linked it
ilammy · 2020-08-02
This is literally untrue. Zero-knowledge comparison protocols exist [1], and their goal is to prevent malicious party from obtaining any knowledge of the secret. Yes, the genuine server will have its copy of the password (or its hash, whatever) and the user will have their copy of the password too. What you don't want is to have the user send their copy of the password to a place which looks like your server but isn't.
[1]: https://www.cossacklabs.com/files/secure-comparator-paper-rev12.pdf
EDIT: I mean, yeah, you're right in the sense that whatever you send to the server is used to authenticate you, so that whatever is a 'password' of a sort by definition. However, using the raw password as is for authentication is not a great idea. If you intercept the password, you will be able to compromise any further authentications. There are alternatives that avoid this.
ignoramous · 2021-06-15
Well, FHE may not be there yet but there are other approaches using functional encryption (?) [ref] concepts, like this one I stumbled upon: https://www.cossacklabs.com/blog/secure-search-over-encrypted-data-acr…
[ref] https://cseweb.ucsd.edu/~daniele/LatticeLinks/FE.html
cossacklabs · 2015-12-09
... and a more formal whitepaper for cryptographic people:
https://cossacklabs.com/static/secure-comparator-paper-v1.pdf