Hacker News new | ask | show | jobs
by tgb 2006 days ago
I think these concepts are significantly different - as different as salts and peppers at least. Peppering helps protect against database access revealing password. Horcrux protects against password manager access. Peppering is stored on the server, but outside the database. Horcruxes are stored in the user's head. You could do both, one, or neither. Client-side peppering would be having part of your password outside of the password manager but still on your computer. If anything it's brain-side peppering.
1 comments
kbenson 2006 days ago
> Peppering helps protect against database access revealing password. Horcrux protects against password manager access.

What is a password manager but a database of your passwords? Peppering is a token that is not in the database of passwords that needs to be applied for the password to be correct. Whether it's applied by an application, or a person doesn't seem relevant, as what is an application but a set of instructions a person could do carried out automatically?

I don't care what it's called, but I don't really see a difference in the scenarios you've outlined.

link
e12e 2006 days ago
> Peppering is a token that is not in the database of passwords that needs to be applied for the password to be correct.

Well, typically a server only cares about verifying the user (still) knows a password.

A typical server (today) does not have a way to reconstruct the plain password, only a way to check if any given string matches.

A password manager, typically does have a way to supply the password.

Peppers and salts are typically manipulated by the server system, plain passwords are typically managed by the password manager.

In this case the password manager never sees the hocrux, and cannot leak it. A server will typically leak a pepper to anyone with access to ram (or access to a hw enclave, which is expected to be more difficult).

link
tgb 2006 days ago
Frankly this has more in common with a 2FA approach with one factor being the password manager and the other your horcrux. I wouldn't call my phone authenticator app a client-side pepper.
link