SpiderOak/crypton — pull request #127 by dhain (2014-01-01 20:33:44+00:00)
Title: Don't send hmacKey to server when saving account

`account.js` `Account.prototype.serialize` returns `this.hmacKey`. The return value from `Account.prototype.serialize` is sent to the server (in `Account.prototype.save`). `this.hmacKey` is the key that is used to encrypt and authenticate the payloads, so disclosing it to the server enables the server to read and forge all payloads. An encrypted copy of `hmacKey` is also sent to the server - `hmacKeyCiphertext`.
Note that the client does not read and use the cleartext copy `hmacKey`, but instead gets the key from `hmacKeyCiphertext`, decrypted and authenticated using `symKey`, in `Account.prototype.unravel`.