Member Avatar for Mr.M
Mr.M 160 Future Programmers

Hi DW.

Well I'm very much interested in the data protection and also giving the best privacy to the public where we protect your passwords. I've seen something that Firefox had introduced to their browsers with also their Apps. This is called LockWise which is a tool to sync your passwords with your other devices.

Now as we are in the 4IR I personally think that such information shouldn't be shared purely with other devices because what will happen when you are not in front of those devices?

Worst of them all we all know that browsers don't encrypts the passwords so this to me opens a very huge security loophole because a person with access to let say your computer can see and copy your passwords as the browsers saves the actual passwords.

With that in mind check BRIWPED on YouTube see the demonstration on this live. I think as we are in the 4IR the only person should know the actual password is the owner only. I don't see a reason why would we still submit the actual password over the internet whereas we can only use the encryption systems like BRIWPED to ensure that only the salts is sent and on the server the encryption MD5 or encrypted RSA1 or any encryption is used so that even on the server there will be no actual user password is received but rather the MD5, RSA1 or any other.

This will make it more harder to hack provided that the user also have AV installed to his computer.

Tools like BRIWPED makes it easy to share like LockWise but not the actual password is shared but the salts which there can be verification to ensure that if the login is to be granted to a site or App but it from the actual user.

What also nice with BRIWPED is that they also have an App that gives you instant notification when there is a login activity and with the App you can instant stop that login.

It can also be used on any website. As we are in the 4IR sensitive information like your passwords should be kept secure and private at all times so only you yourself knows it and not even your browsers or server because what if your browsers or your server gets hacked?

What do you think of this, do you agree that such services and tools like LockWise and I also saw a video on YouTube with the smart key which also carries your passwords and you don't have to type the passwords on the browsers because these keys automatically submit or type it to the browser for you.

We've also seen what had happened to the contactless on the smart cards where hackers now target it and hack it without even touching you. So such things with also happen with the passwords if they are not encrypted at all times.

What is your view on these security issues that are within the 4IR?

  • 1 Contributor
  • 0 Replies
  • 1K Views

Dani AI

Generated

, a few clarifications that may help the discussion. Firefox’s password manager does encrypt saved logins on disk, and Firefox Sync uses end‑to‑end encryption so Mozilla cannot read your synced passwords. For extra local protection, enable a Primary Password on each device; it gates access to stored credentials even if someone is at your keyboard. Firefox’s separate Lockwise app was retired on Dec 13, 2021 and its features live in Firefox on desktop and mobile now. See: Use a Primary Password, How Firefox Sync keeps your data safe, and End of support for Firefox Lockwise.

On the server side, avoid MD5, SHA‑1, or any fast hash. Modern guidance is to store passwords with a unique per‑user salt and a memory‑hard KDF such as Argon2id (preferred), scrypt, or bcrypt, tuned to be slow enough to resist offline cracking. OWASP’s current recommendations are a good baseline: OWASP Password Storage Cheat Sheet.

Example parameters you can apply today:

# Argon2id example (server-side)
salt = random(16 bytes)
hash = Argon2id(password, salt, t=2, m=19456, p=1)  # ~19 MiB, 2 iterations, 1 thread
store: algorithm, params, salt, hash

About sending “only the salt”: a salt is public and not an authentication secret. Typical designs send the password over TLS; the server verifies by hashing with the stored salt. If you want the server to never learn the password at all (even transiently), look at PAKE protocols such as OPAQUE, which provide zero‑knowledge password authentication: RFC 9807 (OPAQUE).

Finally, the “smart key” idea is best realized with FIDO2/WebAuthn security keys or platform authenticators. They do not store or type your passwords; they use phishing‑resistant public‑key cryptography instead: FIDO2 specifications overview.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.