4 ms·
Assuming the password is sent over the wire (rather than the salt being sent to the client, the client doing the hash, and sending the hash), the password will
by iso1210 5y ago
Assuming the password is sent over the wire (rather than the salt being sent to the client, the client doing the hash, and sending the hash), the password will be stored in memory while the login process runs
Normal password code would be
if (doHash(password+salt) == storedHash) {
failedLogins = 0;
return 1;
}
failedLogins++;
return 0;
This would presumably be
if (doHash(password+salt) == storedHash) {
failedLogins = 0;
return 1;
}
if (doHash(swapFirstLetterIfClientIsMobile(password)+salt) == storedHash) {
failedLogins = 0;
return 1;
}
failedLogins++;
return 0;
So while the password is 'stored' in the server side heap, it's no different to normal password 'storage'
If the hash is done in the client it's the same, just the client sends two attempts rather than one.
- the_gipsy 5y agoEven if it’s encrypted, they could send both forms. Edit: not a good idea.
- squeaky-clean 5y agoI'm no security expert, but this would let someone try two unrelated passwords at once and so probably wouldn't be done client-side.