[Discuss] Reusing Passwords on Different Sites Should be OK

[Edward Ned Harvey (blu)]

> From: Bill Ricker [mailto:bill.n1vux at gmail.com]
> Sent: Thursday, September 17, 2015 10:11 PM
> 
> Reusing passwords requires the users to know that the encryption is of a
> safe variety.  Most users are not qualified to tell good crypto from bad
> crypto.  Heck, most programmers can't be qualified to use good cypto
> correctly.
> Password Encryption done client-side must be handled very carefully to
> avoid replay attacks yet still actually validate something.  Sounds like a half-
> hearted attempt at Challenge-response.
> tl;dr No.

Everybody knows they shouldn't login to anything over http://
We've all been trained to use https:// and ensure we have green checkmark security shields or whatever.
Because thousands of random unknown employees maintaining the routers on the Internet could access the http traffic.

When you login via HTTPS, to google, facebook, twitter, and thousands of other sites, there are still thousands of unknown employees maintaining the load balancers and web servers at the other end, who could access the traffic.

It is a no-brainer. You should not send your password or encryption keys, even over https. You need to prove you know your secret without exposing it.