PreAcher: Secure and Practical Password Pre-Authentication by Content Delivery Networks
summary
A three‑party protocol offloads pre‑authentication to CDNs while keeping real passwords secret, combining OPRF + LSH so the CDN filters wrong attempts and the origin performs a final full check. Implementation uses serverless CDN edge code and client JavaScript so it is deployable via CDN edge JavaScript without client changes. Testbed and Internet experiments show it maintains ~100 logins/s under 400 invalid/s and, for 5,000 accounts, K=4 and Q=20 yield under ~2% cracking in their evaluation.
AI-written summary · about
chapters (11)
- 0:00Password pre-authentication intro
- 1:23Attack bypassing CDN defenses
- 2:47Password security limitations
- 3:53PreAcher design insights
- 5:00Malicious CDN insider threats
- 6:23CDN offline attack solutions
- 7:48PreAcher step-by-step
- 8:54Deployment simplicity
- 9:38Evaluation against attacks
- 11:30Cracking rate analysis
- 12:56Conclusion and future work
related talks
39mZen and the art of edge authentication
47mThe state of passwordless auth on the web
30mThe State of Passwordless Auth on the Web
25mPrivacy Pass: A Lightweight Zero Knowledge Protocol Designed for the Web
40mNOPASSWD: Building a Passwordless Cloud Infrastructure
37mAuthentication in 2026: A guide to passkeys, digital credentials and more
27mKeeping passwords safe in 2017
29mPhoenix: Rebirth of a Cryptographic Password-Hardening Service