4 ms·

HTTPS is critical yes. If hash(password) is sent over HTTP in plaintext, then hash(password) can just be used in a replay attack. You shouldn't be sending pas

• avianlyric 6y ago
  Pretty clear case for not hashing however. Hashing the password on the client limits the password entropy to entropy of hash you generate. Any addition entropy in the original password is thrown away. Also naive hashing in the client just turns the hash into your password, all of the standard issues of transmitting passwords still exists (such as replay attacks as you mention).
  • lordlimecat 6y ago
    Entropy is defined by the password. The hash is deterministic.
    • xondono 6y ago
      Maximum entropy is defined by the password, the hash can reduce it.
      • MiroF 6y ago
        As long as the entropy of the client hash and of the server hash is the same, I still fail to see how this is a problem.
        • xondono 6y ago
          AFAIK there isn’t a good reason to do that. To be useful the hash should turn your password into a OTP, at which point it’s no longer a hash
          • lordlimecat 6y ago
            > To be useful the hash should turn your password into a OTP I'm not clear why you think this would be so. Hashes (with salts) prevent attackers from being able to derive the password, and can also be used in conjunction with nonces to prevent replay attacks.
            • xondono 6y ago
              The point is that you are not achieving much. You need both parties to know the nonce and the salt for this to work, so you’ll need to send it over. At this point what value are you gaining over just sending the password?
              • lordlimecat 6y ago
                >You need both parties to know the nonce and the salt for this to work, so you’ll need to send it over. I get the impression you don't understand what the nonce and salt are, so I'll break it down. The salt is used to make the hashes for particular values unique to this site. It generally does not change across the site, but it makes it impractical to use pre-computed hash tables to find the original values for a given hash. By using a salt, the site ensures that transmitted hashes cannot be trivially reversed. The nonce is used to allow the use of an HMAC to create a one-time hash that cannot be reused. This would typically be implemented as follows: 1. Service sends NONCE, SALT 2. Client Sends password as SHA256(SHA256(ClientPasswd + SALT) + NONCE) 3. Service Computes SHA256(StoredSaltedHash + NONCE), confirms that it matches what the user sent 4. If the two match, the user is authed. An attacker cannot reuse what the client sent because the nonce is not reused, and he cannot fake the nonced hash because he does not know either the password or the StoredSaltedHash.
                • dancodes 6y ago
                  As a 3rd party who thought he understood this, but then realized he didn't: thank you for explaining it
                • xondono 6y ago
      • lordlimecat 6y ago
        Hashes do reduce it, by an amount determined by the hash size and algorithm. This has nothing to do with client vs server. SHA1 of STRING will always have the same entropy wherever it is computed; it must, for the hashing to work. EDIT: I suspect you are confusing PRNGs or KDFs with hashing. Entropy is relevant with the former, not the latter.
• lordlimecat 6y ago
  >then hash(password) can just be used in a replay attack. If password is sent over HTTP in plaintext, then password can be used in a replay attack. Of course you can also do a dozen other things with it, such as attack other sites. And of course this flaw is trivially rectified by having the site send a nonce.
  • ssalazar 6y ago
    The nonce can be replayed too. Just use HTTPS and (as a user) don't re-use passwords.
    • muldvarp 6y ago
      If the server sends a nonce and the browser/client responds with hash(password + nonce), a replay attack is not possible.
      • lordlimecat 6y ago
        Technically, you should be doing hash(hash(password) + nonce). The server should not know the password, only the password's hash.
        • fhars 6y ago
          That just turns hash(password) into the effective plain text password, which the server must know in this scheme.
          • lordlimecat 6y ago
            Correct. The server should be storing the password hashed as Hash(Password+Salt) to make it impractical for an attacker to recover the user's password. Recovering whatever the server has stored is typically going to be sufficient to authenticate the user, but storing it as a hash mitigates some threats.
      • fhars 6y ago