3 ms·
Shouldn't you be able to avoid this by simply hashing the password before POSTing it?
by rahuldottech 7y ago
Shouldn't you be able to avoid this by simply hashing the password before POSTing it?
- cestith 7y agoIf you're using JS to prehash before submission, an attacker who has exfiltrated hashes never needs to crack them. It also makes it impossible to degrade gracefully for a non-JS client. You're effectively taking a password hash and turning it into an unhashed password itself.
- DGAP 7y agoYes! But that has various pros and cons as well.