3 ms·
And yet the server sends you the code to hash your password. Either way, if the server compromised, all bets are off. That said, there are architectures where t
by justinjlynn 10y ago
And yet the server sends you the code to hash your password. Either way, if the server compromised, all bets are off. That said, there are architectures where this may make a difference, but they certainly aren't the usual case.
- hvidgaard 10y agoThe difference is that I can verify the code, and the data send. If I send the password to serverside hashing, I can only trust the server to handle it correctly. Security wise that is a fairly important difference.
- temprature 10y agoAre you saying you not only know of some website that does password hashing client-side but that you also inspect the javascript that site serves you every time you login?
- hvidgaard 10y agoSecurity wise there is a difference. This difference don't matter to the average person. I don't reuse passwords, so I don't need this protection.