4 ms·
True, but then you have to mimic the form submission without alerting the user. It's certainly possible, but much less feasible compared to just passive logging
by pingswept 15y ago
True, but then you have to mimic the form submission without alerting the user. It's certainly possible, but much less feasible compared to just passive logging of all POSTs that have a field called [password|pw|pass|passwd].
I guess if you're targeting a single site the difference is small.
- simonbrown 15y agoIt would be just slightly more complicated to inject a script that POSTs back anything typed into a password field. Hashing passwords client-side would just provide a false sense of security. Surely if it's worth doing it, it would be worth the cost of an SSL certificate and the overhead of protecting (a minimum of) all pages and requests handling passwords?
- soumyadeb 15y agoI guess, client side hashing is not used because some users disable javascript. Can't leave them out :)