Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I like that idea, but what do you do when someone changes their password? Decrypt/Reencrypt all their messages?


Easy: encrypt a random encryption key with password (I mean, with a key derived from password). Then encrypt content with this random key. When user changes password, re-encrypt the same key using a new password. No need to re-encrypt contents, because it's still encrypted with the same key.

This is how it's done in most disk encryption software, for example, FileVault.


store the password change history...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: