3 ms·
At the point where I’m on your front end server, I’m not stealing your password, I’m stealing your auth token. I don’t care much about your password once I can
by munchbunny 6y ago
At the point where I’m on your front end server, I’m not stealing your password, I’m stealing your auth token. I don’t care much about your password once I can harvest auth tokens en masse.
Don’t forget about the main point: hashing and salting on the client side does not replace doing the same thing on the server side.
- rl3 6y ago>Don’t forget about the main point: hashing and salting on the client side does not replace doing the same thing on the server side. Per my original, top-level comment: "For that reason, it's a good idea to salt and hash passwords client-side as well." [emphasis.. nevermind.]