Quote from: bob123 on Today at 09:31:10 PM

Quote from: cryptoworld99 on Today at 08:32:48 PM

BOB123 Majority websites on the internet don't need to encrypt passwords beforehand using javascript because it will store your password as the hash LOL and if the server SQL gets dumped the encrypted hash is your password LOOL.

We are not talking about standard web applications.
We are talking about a web wallet.

The whole sense of a web wallet should be that everything will be handled client-side (key generation and encryption) and then uploaded to the server.
This obviously is NOT the case here.
And that is the point here.

sendbit is claiming to not have access to the private keys. However they also admit that they have the encrypted file AND the password to decrypt it. That's the point.

Take a look at blockchain.com.
As much as i dislike web wallet, they are at least doing everything (kind of) right. Key generation and encryption is done client sided. Transaction signing is as well done client-side. The server actually never can access the private key. This is NOT the case with sendbit.io, even tho they claim otherwise.
And i am not even going to talk about open vs closed source now.

Hello,

All password hashing encryption is now generated on the client-side, you can check our headers are secured using bcrypt cost 12 example below

user_name: 31006e07-40f7-4657-a778-4d635ce0fc1a
email: xxxxx@xxxxxxxx.com
password: $2y$12$UsrnjwCpNxVvWyAd170WDeVUydp79FDxdvpn34J.YgpgSfAaPGp6G
csrf_token: 7662e1313fbf1db64b27648bfaa9b95a145dcd1b727562168b41c951d20435ff
register: REGISTER

CSRF is in place and TSL encryption,