OPAQUE: The Password That Never Leaves the Browser

Every password login you have ever written has a dirty little secret: the server sees the password. Maybe only for a few microseconds, maybe only long enough to run it through bcrypt and throw it away — but it sees it. It’s in a request body, it’s in memory, it’s one stray log.Printf away from a breach report. OPAQUE breaks that assumption. It’s an asymmetric password-authenticated key exchange…