5 ms·
and hash the passwords on the browser.
by adamsmith 18y ago
and hash the passwords on the browser.
- anewaccountname 18y agoI agree that that will be safe, provided you use the same browser-side hash function that the bank uses
- theg 18y agoYou can't have it both ways. If you are hashing the password before it is sent from the client to the server, you need the raw password on the server side. (Assuming you are concatenating it with a server-provided random value before the hashing.)
- tptacek 18y agoYou're assuming they're using a secure challenge response protocol. They're not. They're sending password-equivalent hashes over the wire, so they can say they're not sending passwords. You'd be right to point out that this is a lot of silly acrobatics to go through to avoid a single SSL login page.