4 ms·
I don't see how that'd be the case. An attacker who has visibility into the client that has the salt can already see the plaintext password. And an attacker on
by eropple 9y ago
I don't see how that'd be the case. An attacker who has visibility into the client that has the salt can already see the plaintext password. And an attacker on the service side of things can see the salt anyway, it's in the database.
- jedisct1 9y agoAn attacker that would have the ability to impersonate the server could precompute a rainbow table for a given salt, and send that salt to the client. OTOH, without client-side prehashing, an attacker that has the ability to impersonate the server doesn't have to precompute anything in order to collect all passwords.
- Franciscouzo 9y agoIf an attacker is able to impersonate the server, then it is also able to ask the client for the password by modifying the Javascript sent.
- jedisct1 9y agoAll clients are not web browsers, but sure.
- Buge 9y ago>An attacker who has visibility into the client that has the salt can already see the plaintext password. There is no way for the server to distinguish a legitimate user trying to login from an attacker trying to hack someone. So if the salt is sent to a legitimate client, the salt will also be sent to attackers. I'm not sure if sending the salt to attackers is really a vulnerability though.