CBCrypt: Encrypt from the client rather than send passwords to servers
So essentially this is a really convoluted way of concatenating username, password, and domain then running scrypt() on it, and sending that to the server as the password instead of the raw password itself?<p>I actually read the Github page for this, and glanced over the C#. There's no realistic example of how this would work in practice, and I have unanswered questions. This would legitimately solve some phishing scenarios and MIGHT slightly mitigate password reuse scenarios (since they know username + domain, they now need to spend time cracking scrypt() on the password). The arguments that it helps user privacy (NSA something something) are tin foil hat wearing jibberish.<p>Overall: Meh. If they're serious about this, they need more than a vague proposal.<p>PS - And a password manager solves all of the named issues with less complexity in my opinion.