How is zero knowledge maintained when the password is used to log in to the Boxcryptor website?

AdamSwetnam

While presumably the password is hashed, it is considered security best practice to hash server side, so that the plain text password would be sent to the Boxcryptor servers. How is this compatible with Boxcryptor being zero knowledge?

Christian

Hello Adam,

Boxcryptor does not send the password to our server. Instead, it does send a hash of the password, which is once again hashed on our server for storage. Please have a look at our technical documentation (https://www.boxcryptor.com/en/technical-overview/) for more details on this.

Best regards,
Christian