4 ms·
>If you compromise the server, you’re well past caring about the individual passwords anyway because you can just serve a version of the client code that doesn’
by rl3 6y ago
>If you compromise the server, you’re well past caring about the individual passwords anyway because you can just serve a version of the client code that doesn’t hash on the client side.
What if the client files are delivered via CDN, and the server in this case is an API?
- munchbunny 6y agoAt the point where I’m on your front end server, I’m not stealing your password, I’m stealing your auth token. I don’t care much about your password once I can harvest auth tokens en masse. Don’t forget about the main point: hashing and salting on the client side does not replace doing the same thing on the server side.
- rl3 6y ago>Don’t forget about the main point: hashing and salting on the client side does not replace doing the same thing on the server side. Per my original, top-level comment: "For that reason, it's a good idea to salt and hash passwords client-side as well." [emphasis.. nevermind.]