Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can someone explain a bit more how “remember me” works? If symmetric encryption requires a “key” to decrypt - one might expect that you will need to store that key to auto-decrypt. But here it claims that the key is stored salted and hashed. But to auto-decrypt - you need to reverse that salt and hash because you need that key back. How would that work?


The passphrase+salt get hashed. This hashed-passphrase is what decrypts the file.

You can store the hashed-passphrase in local storage. This means you can auto-decrypt again. You don't need the original passphrase.

If bad guys get your computer, they can read the file. However, they cannot trivially work out what your original passphrase was, so it protects you a little if you reused your passphrase elsewhere.


Thanks!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: