Opaque: Passwords Never Leave Your Device

blog.cloudflare.com

17 pointsr4um2 comments

Some services like MEGA and LastPass will encrypt your data with your password to assure you that they can't read it even if they tried. However, this results in the inability to reset your password- if you go to MEGA and try resetting your password (and have no other authenticated instances) you'll lose all your data.

Wouldn't using a PAKE remove the ability to encrypt data with a password, because it is never being sent over cleartext? Also, wouldn't that mean you could no longer be sure that your data wasn't being viewed by the service?

I think the server would be able to encrypt with the user's public key, that way they wouldn't be able to read it. They'd have to send the encrypted data to the client to be decrypted with the private key there

Reply on news.ycombinator.com