Brave Software, maker of Brave Browser, announced the launch of Brave Accounts yesterday. While the main idea of introducing native accounts is similar to how other browsers handle user accounts, that is, allowing users to sync data and use other services associated with the account, Brave Software uses technology that is vastly different.
Instead of sending hashes or encrypted passwords to remote servers, Brave Software says that passwords never leave the browser in the first place. It is “never transmitted”, which eliminates the need to trust a company securely storing password data in the first place.
Brave writes:
Here’s the short version: when you sign in to a service built on Brave Accounts, your password itself is never sent to our servers: not encrypted, not hashed, nor “briefly held in memory and then discarded”. The password is never transmitted, so you don’t have to “trust” that we are keeping it safe for you. We don’t know it at sign-up, we don’t know it at login, and if someone were to steal our entire password database tomorrow, with high probability they still wouldn’t know it.
Brave uses OPAQUE, “an augmented password-authenticated key exchange” for that. The underlying idea is that it allows the client — the browser in this case — to prove that the password is known without revealing it.
Technically the system relies on an Oblivious Pseudorandom Function.
This means that: you blind your password with a random value and send the blinded version of it; the server applies a secret key it holds and sends the result back; then, your device unblinds it. The output is a value derived from both your password and our server-side secret (the secret key), but the server learned nothing about your password, and you learned nothing about the key.
There are three advantages to using this method instead of the traditional password-hash checking according to Brave Software:
- Passwords are never transmitted.
- Attackers can’t use password dictionaries in their attacks.
- The export key can be used for other tasks, such as end-to-end encryption.
Email Aliases
One of the first features to make use of the new account system is email aliases. It allows Brave users to keep their personal email addresses private by creating aliases.
Sites communicate only with the alias, which forwards messages to your “real” email address.
After you create a new Brave account, you get the option to use email aliases right in settings or while signing up for a new account on any website.
The main new address seems to be bravealias.com, which should work for the time being on most sites. Eventually, some sites will start to block and it would be a good idea to get additional options regarding the alias domain that one can pick for the alias.
All users get five free email aliases once they have set up a Brave account. Brave Software plans to introduce a paid upgrade option in the future, but has not revealed any details on that at the time of writing. It is very likely that it will feature higher limits, if any, and maybe also other alias options.
