3 ms·
> If I was a hacker, I can add JavaScript to send plaintext somewhere. If I was a hacker, I could change the login form to stop hashing them client-side and ins
by throw0101a 5y ago
> If I was a hacker, I can add JavaScript to send plaintext somewhere. If I was a hacker, I could change the login form to stop hashing them client-side and instead send them over to the server for hashing and inspection.
If a zero knowledge (ZK) system combined with HTTP Basic was used, then account entry would come from the browser itself and not a web form that could be intercepted by JavaScript.
Further, a ZK system would help with the silliness of folks using bad algorithms (straight MD-5 / SHA-1) to store passwords, or even storing them in plain-text.
- gjsman-1000 5y agoRight - it would, I don't disagree, it'd be awesome. It's something like WebAuthn. I'm arguing here more against some people who think that using a JavaScript-based system to hash the password entry before sending it to the server is a good idea.