3 ms·
> Hashing in the client leads to a fair share of security issues, especially if it's not also hashed on the backend using the usual salted hashes. Sure, if you
by MiroF 6y ago
> Hashing in the client leads to a fair share of security issues, especially if it's not also hashed on the backend using the usual salted hashes.
Sure, if you're foolish enough to not hash on the server side then you're setting yourself up for failure. But I fail to see what the problem with hashing on the client side is?
- fhars 6y agoIt doesn’t hurt much, but it doesn’t help much either, especially for web applications. If the user cannot trust that the server doesn’t do bad things with the password, they also cannot trust the javascript hash function sent from the same server, so it does not protect against the scenario discussed here. And it is no substitute for an encrypted connection.
- arghwhat 6y agoNo, it does hurt. It also means that you're making up crypto protocols, which is not something you do for fun. Use SRP or similar if you need private password transfers (which again is still pointless if the client isn't trusted).