3 ms·

I think you want to be able to verify that the password is secure (greater than a certain length, uses capitals and symbols, etc.) if you just pass the hash ba

by itake 8y ago

I think you want to be able to verify that the password is secure (greater than a certain length, uses capitals and symbols, etc.) if you just pass the hash back to the server, you can't verify that the password was secure.

the8472 8y ago
That can also be verified on the client side.
- itake 8y ago
  How do you trust the client verified it correctly?
  - the8472 8y ago
    The client attempting to bypass password complexity checks on registration is not part of most threat models. I.e. they're not an attacker, it's more of a user aid.
andrius4669 8y ago
But you can do the same in JavaScript. More serious reason is imo js requirement, as I'm not aware of native support of password hashing in HTML forms. Also, different ways of hash keying/salting would make it either complicated or inflexible..