3 ms·
It doesn’t hurt much, but it doesn’t help much either, especially for web applications. If the user cannot trust that the server doesn’t do bad things with the
by fhars 6y ago
It doesn’t hurt much, but it doesn’t help much either, especially for web applications. If the user cannot trust that the server doesn’t do bad things with the password, they also cannot trust the javascript hash function sent from the same server, so it does not protect against the scenario discussed here. And it is no substitute for an encrypted connection.
- arghwhat 6y agoNo, it does hurt. It also means that you're making up crypto protocols, which is not something you do for fun. Use SRP or similar if you need private password transfers (which again is still pointless if the client isn't trusted).