3 ms·
This is only true when client-side hashing is under control of the client. In a web browser, it is not. The browser will happily run whatever JS the server send
by snowwrestler 8y ago
This is only true when client-side hashing is under control of the client. In a web browser, it is not. The browser will happily run whatever JS the server sends it. So if the server is compromised, it can send compromised JS, and there goes your client-side hashing protections.
An example of where it might work is in an app, where you're getting the client code from a separate channel like an app store.
- brod 8y agoor a separate channel like another server - which is the standard in every large web application I've ever seen.
- Isinlor 8y agoIt can protect you against non-malicious issues on server-side. If I recall correctly, twitter recently discovered that they were logging passwords in plaintext by accident. With hashed password you reduce exposure of actual passwords in this type of situation.