4 ms·
My take on client-side hashing schemes is that they help with raising the floor - - they ensure that the backend application never sees your password in plai
by maxwellg 3y ago
My take on client-side hashing schemes is that they help with raising the floor -
- they ensure that the backend application never sees your password in plaintext , and prevent the worst case scenario of a plaintext data dump
- password hashing is CPU intensive by design, and pushing that work to the client means you can have them do the work and increase # of iterations far more aggressively
but fundamentally still leaves users vulnerable compared to other approaches. For example, client-side hashed passwords can still be phished, and are not domain-bound like Passkeys are.
- xg15 3y agoI think with the "X can be phished" argument, there is a massive tradeoff to keep in mind: Everything where you as a user have direct access to the key can in theory be phished. So the only way to make credentials unphishable is by hiding the key from yourself and entrusting it to a third party, in the way that passkeys work. However, now you're entirely dependant on that third party. The question is if, everything considered, this is really such a big security improvement for you. I think an alternative approach would be to accept a certain risk that credentials can be stolen and improve the ways in which stolen credentials can be revoked.
- rad_gruchalski 3y agoWhat sort of hashing algorithm do you use?