3 ms·
The client usually doesn't send hashes of passwords. Has he's are computed server side. Sending client side hashes beings no benefits
by freemint 5y ago
The client usually doesn't send hashes of passwords. Has he's are computed server side. Sending client side hashes beings no benefits
- naniwaduni 5y agoDouble-hashing (peppered on client, salted on server) does have a modest benefit: the passwords are no longer sent in plain-text and cannot be cheaply intercepted by a passive eavesdropper (i.e. without observably tinkering with the data sent). This often isn't considered worth the accessibility and maintenance costs of requiring the user to compute a hash (the threat model isn't exactly hugely concerning, especially to service providers, and is mostly obviated by transport encryption anyway) or the risk that somebody's going to come along and ask why we're hashing twice and rip out the server hash (very bad), but calling that "no benefits" is more or less lies-to-children.
- freemint 5y agoI've considered that but then there is transport encryption.