4 ms·

Right but that's not really an excuse not to do them right.

• pixl97 3y ago
  You're working at the premise backwards... One of the systems is already wrong. The excuse not to do the system right is monetary cost of fixing the broken system. Out of all the excuses in the world, money wins.
  • junon 3y ago
    EDIT: responded to the wrong comment, apologies. I really don't understand your point. If I hash on the browser the hash is still being sent to the server. A MitM or sniffing attack can just send the hash and log in. It doesn't actually protect the user at all unless they're re-using the password elsewhere. This also assumes that you're using a seeded hash of some sort, or a multi-round hasher with settings unique to every other website. Otherwise you're still going to run into stuffing and collisions. So for sites where the plaintext password is sensitive (password managers etc) that's important. For most sites, it's not inherently wrong not to hash passwords in the browser, though it does protect against password reuse. I'm not saying you're wrong, I just don't think you're accurately portraying the problem you're fixing.