3 ms·

Why is it normal to not hash passwords in the browser before sending them over the wire? Seems like it's opening the door to issues such as this one, or even m

Why is it normal to not hash passwords in the browser before sending them over the wire? Seems like it's opening the door to issues such as this one, or even more serious ones like when cloudflare leaked web server memory into other sites. I understand that you'd still need another hashing layer before inserting it into the db, but wouldn't some hashing client-side be useful?

gol706 8y ago
For all intents and purposes that hash becomes the users password at that point. Also you can't really salt that hash in a meaningful way.
throwawaysec101 8y ago
Yes we should be hashing to avoid these sort of password logging issues. This is one of those old internet tech-debt that should be resolved in the future either via JS or HTML standard where password is hashed before sending to the server. Reasons for this are: - Internet services have grown and it's too much of a burden for user to have different password for every service. - Even if users have different password, they use the same pattern and add some number of special character at the end which defeats the purpose if password pattern is revealed. In order to protect the pattern of password across multiple services these login services should use client-side hashing. Think of it like something along the lines of SSL green icon in chrome, services not using client-side hashing are leaking it somewhere (no way to tell if they are not leaking).
mic47 8y ago
This does not help at all. If you hash client side,then the hash will became your password. If you accidentally log this hash, anyone who have access to that hash can log in as you easily by constructing logun request.
- deleted 8y ago
  [deleted]