5 ms·
Never trust the client.
by jensvdh 10y ago
Never trust the client.
- XorNot 10y agoThis isn't about trusting the client: it's about your endpoint being able to only accept a SHA256 hash sum from the client (thus: length limited) while allowing the user to input arbitrarily long passwords. They hash in the browser: the only way they can mess with it by producing silly outputs, but that only hurts them.
- libeclipse 10y agoI can't think of any security implications of hashing on the client-side. What's your thinking?
- fnordsensei 10y agoDoes salting work if you hash in the browser?
- libeclipse 10y agoWell in this case the hash would be passed to Bcrypt or Scrypt, which have built in salt support, so client side salting wouldn't matter.
- shawnz 10y agoIf the hashes are leaked, you could log in with them.
- XorNot 10y agoWell serverside you store them as plaintext equivalents - i.e. salt+hash the hash. So a leak doesn't leak the user-side.