[Cfrg] OPAQUE at Facebook

[Kevin Lewi <[e-mail]>]

Hi all,

At Facebook, we are currently evaluating various methods for improving
the handling of plaintext user passwords server-side, and one proposal
which has caught our interest is using an augmented PAKE like OPAQUE
to completely avoid having the plaintext password sent (over TLS) to
the server during user login and account registration. Our primary
motivation is to prevent prior incidents involving the storing of
plaintext passwords due to logging bugs from ever happening again.

It is true that we do not need a cryptographic solution to avoid
logging plaintext passwords, and indeed, we have considered a myriad
of solutions to prevent such logging, including automated detection
mechanisms which regularly scan our data warehouse for plaintext
passwords. Of course, not having access to the plaintext password via
an augmented PAKE is not only a much cleaner solution, but it also
provides better guarantees. As a result, we have started to look into
what it would take to implement OPAQUE as an alternative login
mechanism for specific apps and supported devices.

This problem is also not specific to Facebook -- in the past two
years, Github, Twitter, Google, Robinhood, and Coinbase have all
reported a similar problem of accidentally logging plaintext
passwords.

It would be great to hear from this group on where the community
stands with the standardization of augmented PAKEs.

- Kevin