3 ms·
1. If the client is written by the same people as the server, then it provides no improvement in password confidentiality. 2. It provides no additional securit
by arghwhat 6y ago
1. If the client is written by the same people as the server, then it provides no improvement in password confidentiality.
2. It provides no additional security in the authentication process.
3. It provides no additional security-at-rest for post-breach protection.
Doing something like that ends up in the dangerous bucket of duct-tape crypto. I don't mind people playing with crypto, but things are not as simple as they seem, and "more" is not necessarily better.
- SiNiquity 6y agoThe client in this case should be the web-browser; it shouldn't be custom Javascript. There should be an attribute on the password field that says if the password should be hashed before sent to the server. It could also be salted by the browser to reduce reuse across sites similar to any password manager today.