3 ms·
Just idly wondering... I wonder how many AJAX style sites do password checking server side and send the password to the server in plain text...
by mikekchar 7y ago
Just idly wondering... I wonder how many AJAX style sites do password checking server side and send the password to the server in plain text...
- mr_toad 7y agoHashing the password on the client doesn’t really gain you anything. The hash becomes the password (effectively), and you end up having to hash the hash on the server side to maintain security anyway. https://security.stackexchange.com/questions/8596/https-security-should-password-be-hashed-server-side-or-client-side https://security.stackexchange.com/questions/8596/https-secu...
- mikekchar 7y agoI suppose it will be exchanged via HTTPS, so the risks are minimal...
- arethuza 7y agoWhat would the alternative be - sending the stored hash from the server so the comparison can be done on the client side? That doesn't sound like a great idea...