4 ms·

Actually, Passwords should never be hashed client side. Otherwise, a man in a middle attack could intercept the hash and get your password, allowing them to log

Actually, Passwords should never be hashed client side. Otherwise, a man in a middle attack could intercept the hash and get your password, allowing them to log in. Instead, the password should be encrypted to the server, and hashed there.

hvidgaard 10y ago
If a MitM attack can get my hash, what do you think they can get if I send the password to be hashed by the server?
- grey-area 10y ago
  So what does your hash add?
  - hvidgaard 10y ago
    Verifiable protection against data breaches.