5 ms·

If they were following best practices, the server would never have access to plaintext passwords. The client / frontend would hash the password contents and sen

If they were following best practices, the server would never have access to plaintext passwords. The client / frontend would hash the password contents and send that across the wire.

javagram 8y ago
That’s hardly a best practice and if followed consistently just means that the hash is your actual password, which means if someone steals the hash from a log file they can still impersonate you. Unless you actually mean some sort of challenge response scheme which is rather uncommon to see, e.g. http “digest” authentication or SRP.
- qpiox 8y ago
  The big problem of a service having your true password (instead of the hash of the password) is that many users use the same password for a multitude of services (read Gmail, Hotmail, Yahoo, Amazon, ...) So it's bad practice to keep or transfer the users cleartext password. It should never leave her browser/client. Period.
  - javagram 8y ago
    Password managers and service specific 2FA solve that problem quite nicely for now (edit: although yes most users aren’t willing to do that).
  - aeorgnoieang 8y ago
    If the service has only the hash of the password, then that's the password, which would then be subject to the same problems as a "cleartext password".
throwawaymath 8y ago
That's actually not a best practice; on the contrary it's extremely uncommon. Not because it's bad, but because it just doesn't actually add a meaningful security improvement. On the other hand, it does add non-negligible complexity to your authentication system. In particular, it would have done absolutely nothing to prevent this specific vulnerability. If you hash your users' passwords using a key-derivation algorithm on the client-side, each user's password simply becomes the original password's digest. From the server's perspective nothing has changed. Moreover the server will need to re-hash the password digest sent over the wire, because if the server is compromised the password digests can be directly replayed to the server to compromise corresponding accounts. Additionally, since the shared secret between the client and server is the user's password digest, the password needs to be hashed using the same salt every time the user authenticates. So each user's password digest is still a de facto unique password which will be sent over the wire anyway. This scheme basically retrofits the server's job onto the client with added complexity. It's like the (slightly) faster horses version of password authentication, when we could really be experimenting with developing cars (like two/multi-factor authentication, more robust server-side controls and provable correctness). That's not to say the scheme has no benefits whatsoever. It does mean that user passwords will be more complex, because the actual token stored by the server (the de facto password) is a digest. But there are two drawbacks - with enough users you'll still see many duplicated digests in your password database, even if you randomly generate salts on the client side. More importantly, you're offloading hashing to the client side in JavaScript. JavaScript can be very fast in 2019, but companies like Facebook and Google still maintain very low latency, substantially stripped-down versions of their websites[1] because client-side hashing isn't going to be nearly as fast as server-side hashing for a huge number of people. There's also a sizable population of people who don't even have JavaScript enabled, or who might have incompatible browsers. tl;dr - Client-side hashing is not a best practice (and not widely deployed) because it comes with a nontrivial complexity increase, lower client compatibility and negligible security benefits. It also would not have prevented this vulnerability. _______________________ 1. For example, mbasic.facebook.com.
- voidlogic 8y ago
  Your criticism (outside of complexity) of the suggestion may be unfounded, consider: Client: asks server for nonce Server: sends nonce ---- OR ---- Nonce arrives with login page Client: sends HMAC(nonce + HMAC(username + password + appname) + Unix Epoch rounded to last 5 min block)) Server: 1. gets response 2. using username as key pulls HMAC(username + password + appname) from DB 3. Computes HMAC(last nonce sent to username + DB HMAC + Unix Epoch rounded to last 5 min block)) and compares to user token 4. last nonce is cleared This algorithm would have prevented the attack (only the client computed HMAC would be in the logs) and is not subject to replay.
  - viraptor 8y ago
    This is the same as: Server sends nonce Client sends HMAC(nonce + password + time) Your inner HMAC becomes the new password which now is stored in plaintext in the DB. You just call it something else. There are better ways to implement this idea, like SRP/PAKE https://en.m.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...
  - throwawaymath 8y ago
    To be fair what you're describing is a PAKE, which is substantially different from "merely" moving the key-derivation functionality of password hashing from the server to the client. They're categorically different things. But you're right - if you're going down the rabbit hole of client-side hashing, you might as well implement a PAKE instead. This kind of gets to the heart of what I was referring to when I said client-side hashes are like faster horses rather than cars. If you're spending this much effort, a superior protocol is better than an unorthodox, modified one. SRP is a PAKE which basically takes your proposal and moves it into a different layer of abstraction (TLS), and OPAQUE makes improvements upon it which allow you to use elliptic curves[1]. There are other reasons not to use PAKEs, but they're a much more coherent and defensible suggestion than just bolting the key derivation system onto the client rather than the server. ______________________ 1. https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/ https://blog.cryptographyengineering.com/2018/10/19/lets-tal...

If they were following best practices, the server would never have access to plaintext passwords. The client / frontend would hash the password contents and send that across the wire.

javagram 8y ago

That’s hardly a best practice and if followed consistently just means that the hash is your actual password, which means if someone steals the hash from a log file they can still impersonate you. Unless you actually mean some sort of challenge response scheme which is rather uncommon to see, e.g. http “digest” authentication or SRP.

qpiox 8y ago
The big problem of a service having your true password (instead of the hash of the password) is that many users use the same password for a multitude of services (read Gmail, Hotmail, Yahoo, Amazon, ...) So it's bad practice to keep or transfer the users cleartext password. It should never leave her browser/client. Period.
- javagram 8y ago
  Password managers and service specific 2FA solve that problem quite nicely for now (edit: although yes most users aren’t willing to do that).
- aeorgnoieang 8y ago
  If the service has only the hash of the password, then that's the password, which would then be subject to the same problems as a "cleartext password".

throwawaymath 8y ago

That's actually not a best practice; on the contrary it's extremely uncommon. Not because it's bad, but because it just doesn't actually add a meaningful security improvement. On the other hand, it does add non-negligible complexity to your authentication system. In particular, it would have done absolutely nothing to prevent this specific vulnerability. If you hash your users' passwords using a key-derivation algorithm on the client-side, each user's password simply becomes the original password's digest. From the server's perspective nothing has changed. Moreover the server will need to re-hash the password digest sent over the wire, because if the server is compromised the password digests can be directly replayed to the server to compromise corresponding accounts. Additionally, since the shared secret between the client and server is the user's password digest, the password needs to be hashed using the same salt every time the user authenticates. So each user's password digest is still a de facto unique password which will be sent over the wire anyway. This scheme basically retrofits the server's job onto the client with added complexity. It's like the (slightly) faster horses version of password authentication, when we could really be experimenting with developing cars (like two/multi-factor authentication, more robust server-side controls and provable correctness). That's not to say the scheme has no benefits whatsoever. It does mean that user passwords will be more complex, because the actual token stored by the server (the de facto password) is a digest. But there are two drawbacks - with enough users you'll still see many duplicated digests in your password database, even if you randomly generate salts on the client side. More importantly, you're offloading hashing to the client side in JavaScript. JavaScript can be very fast in 2019, but companies like Facebook and Google still maintain very low latency, substantially stripped-down versions of their websites[1] because client-side hashing isn't going to be nearly as fast as server-side hashing for a huge number of people. There's also a sizable population of people who don't even have JavaScript enabled, or who might have incompatible browsers. tl;dr - Client-side hashing is not a best practice (and not widely deployed) because it comes with a nontrivial complexity increase, lower client compatibility and negligible security benefits. It also would not have prevented this vulnerability. _______________________ 1. For example, mbasic.facebook.com.

voidlogic 8y ago
Your criticism (outside of complexity) of the suggestion may be unfounded, consider: Client: asks server for nonce Server: sends nonce ---- OR ---- Nonce arrives with login page Client: sends HMAC(nonce + HMAC(username + password + appname) + Unix Epoch rounded to last 5 min block)) Server: 1. gets response 2. using username as key pulls HMAC(username + password + appname) from DB 3. Computes HMAC(last nonce sent to username + DB HMAC + Unix Epoch rounded to last 5 min block)) and compares to user token 4. last nonce is cleared This algorithm would have prevented the attack (only the client computed HMAC would be in the logs) and is not subject to replay.
- viraptor 8y ago
  This is the same as: Server sends nonce Client sends HMAC(nonce + password + time) Your inner HMAC becomes the new password which now is stored in plaintext in the DB. You just call it something else. There are better ways to implement this idea, like SRP/PAKE https://en.m.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...
- throwawaymath 8y ago
  To be fair what you're describing is a PAKE, which is substantially different from "merely" moving the key-derivation functionality of password hashing from the server to the client. They're categorically different things. But you're right - if you're going down the rabbit hole of client-side hashing, you might as well implement a PAKE instead. This kind of gets to the heart of what I was referring to when I said client-side hashes are like faster horses rather than cars. If you're spending this much effort, a superior protocol is better than an unorthodox, modified one. SRP is a PAKE which basically takes your proposal and moves it into a different layer of abstraction (TLS), and OPAQUE makes improvements upon it which allow you to use elliptic curves[1]. There are other reasons not to use PAKEs, but they're a much more coherent and defensible suggestion than just bolting the key derivation system onto the client rather than the server. ______________________ 1. https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/ https://blog.cryptographyengineering.com/2018/10/19/lets-tal...