Clipaha: a free software library to move password hashing to the client
summary
Clipaha is a free-software JS + WebAssembly library that moves memory‑hard password hashing (Argon2‑style) into the browser, producing a server‑storeable verifier built from the app identifier and a canonicalized username. It exposes presets low/medium/high and parameterizes memory vs iterations so mobile devices use memory‑heavy, low‑iteration profiles while desktops use higher iterations, and it reports example timings like 0.1s on desktop and ~1–5s on phones; the library runs and integrates with registration/login flows.
AI-written summary · about
chapters (9)
- 0:00Clipaha introduction
- 4:50Server-side hashing flaws
- 10:25Client-side hashing move
- 16:26Client-side hashing challenges
- 20:17JavaScript and WASM implementation
- 25:18Security and timing attacks
- 30:08Clipaha's hashing approach
- 36:29Clipaha demo
- 40:55Q&A
related talks
27mKeeping passwords safe in 2017
42mPassword Hashing
09mLet’s Hash: Helping Developers with Password Security
46mCryptography For Beginners
23mKeeping secrets with JavaScript
36mThe Slower the Stronger: A Story of Password Hash Migration
51mThe Slower the Stronger: A Story of Password Hash Migration
16mThe end of forgotten passwords - Biometric Authentication