3 ms·

Yes. That is the standard behaviour that nearly all sites use, and is perfectly fine.

repsilat 14y ago
It's not great, though - it means that someone who hacks your server can get users' passwords a lot easier. I read a couple of weeks ago that Blizzard's games don't send the passwords to the server, they send a hash. Things are necessarily crappier on the web, of course. Edit: there's more detail at the link below. It looks clear that in at least some of their schemes they deliberately do not send the client password to the server, which sounds like a decent idea. http://www.skullsecurity.org/blog/2012/battle-net-authentication-misconceptions http://www.skullsecurity.org/blog/2012/battle-net-authentica...
- mike-cardwell 14y ago
  If the server is hacked, then all bets are off. They can just modify the webpage if they want the un-hashed password.
  - repsilat 14y ago
    Exactly - "Things are necessarily crappier on the web, of course." I wonder, though. Could there be a "code has changed" warning from the client? I mean, authentication should be pretty damn stable, and maybe even universal. If someone does modify the page, it'd be nice to know if that change was reflected on other sites, and it'd be nice to know that someone I trust had signed off on it (cryptographically). A simple alternative is to build it into browsers. A password field could generate a salt per-domain and automatically encrypt any queries to password-fields. The server doesn't even need to know about it. You'd have to be more than a little careful building it, obviously, and you'd have to find a way to deal with passwords used on more than one site, but it could work.
- Retric 14y ago
  Sending a hash is no different than sending a plain text password. Because the attacker has complete control at their end and can just hack a client that sends that same hash even if they don't know the original password.
  - monkeyfacebag 14y ago
    Would it not be an aid to users in cases where they are reusing the same password on multiple sites?
lolcraft 14y ago
Note that getting the client to send only the hashed password is incredibly silly. If there's a leak, the hackers do not even have to crack those passwords.

It's not great, though - it means that someone who hacks your server can get users' passwords a lot easier. I read a couple of weeks ago that Blizzard's games don't send the passwords to the server, they send a hash. Things are necessarily crappier on the web, of course. Edit: there's more detail at the link below. It looks clear that in at least some of their schemes they deliberately do not send the client password to the server, which sounds like a decent idea. http://www.skullsecurity.org/blog/2012/battle-net-authentication-misconceptions http://www.skullsecurity.org/blog/2012/battle-net-authentica...

mike-cardwell 14y ago
If the server is hacked, then all bets are off. They can just modify the webpage if they want the un-hashed password.
- repsilat 14y ago
  Exactly - "Things are necessarily crappier on the web, of course." I wonder, though. Could there be a "code has changed" warning from the client? I mean, authentication should be pretty damn stable, and maybe even universal. If someone does modify the page, it'd be nice to know if that change was reflected on other sites, and it'd be nice to know that someone I trust had signed off on it (cryptographically). A simple alternative is to build it into browsers. A password field could generate a salt per-domain and automatically encrypt any queries to password-fields. The server doesn't even need to know about it. You'd have to be more than a little careful building it, obviously, and you'd have to find a way to deal with passwords used on more than one site, but it could work.
Retric 14y ago
Sending a hash is no different than sending a plain text password. Because the attacker has complete control at their end and can just hack a client that sends that same hash even if they don't know the original password.
- monkeyfacebag 14y ago
  Would it not be an aid to users in cases where they are reusing the same password on multiple sites?

lolcraft 14y ago

Note that getting the client to send only the hashed password is incredibly silly. If there's a leak, the hackers do not even have to crack those passwords.