2 ms·
If you hash it you can't determine the "strength" of the password except maybe looking up the hash in a rainbow table.
by guelo 10y ago
If you hash it you can't determine the "strength" of the password except maybe looking up the hash in a rainbow table.
- mabbo 10y agoDo your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this password was already used, etc).
- whiskeySix 10y agoany clientside validation can easily be bypassed using something like fiddler.
- FabHK 10y agoPassword strength checking is (properly understood, in my view) providing help to the user, not enforcing some silly and annoying "password validation" rules.