3 ms·

It's not great, though - it means that someone who hacks your server can get users' passwords a lot easier. I read a couple of weeks ago that Blizzard's games d

It's not great, though - it means that someone who hacks your server can get users' passwords a lot easier. I read a couple of weeks ago that Blizzard's games don't send the passwords to the server, they send a hash. Things are necessarily crappier on the web, of course. Edit: there's more detail at the link below. It looks clear that in at least some of their schemes they deliberately do not send the client password to the server, which sounds like a decent idea. http://www.skullsecurity.org/blog/2012/battle-net-authentication-misconceptions http://www.skullsecurity.org/blog/2012/battle-net-authentica...

mike-cardwell 14y ago
If the server is hacked, then all bets are off. They can just modify the webpage if they want the un-hashed password.
- repsilat 14y ago
  Exactly - "Things are necessarily crappier on the web, of course." I wonder, though. Could there be a "code has changed" warning from the client? I mean, authentication should be pretty damn stable, and maybe even universal. If someone does modify the page, it'd be nice to know if that change was reflected on other sites, and it'd be nice to know that someone I trust had signed off on it (cryptographically). A simple alternative is to build it into browsers. A password field could generate a salt per-domain and automatically encrypt any queries to password-fields. The server doesn't even need to know about it. You'd have to be more than a little careful building it, obviously, and you'd have to find a way to deal with passwords used on more than one site, but it could work.
Retric 14y ago
Sending a hash is no different than sending a plain text password. Because the attacker has complete control at their end and can just hack a client that sends that same hash even if they don't know the original password.
- monkeyfacebag 14y ago
  Would it not be an aid to users in cases where they are reusing the same password on multiple sites?

mike-cardwell 14y ago

If the server is hacked, then all bets are off. They can just modify the webpage if they want the un-hashed password.

repsilat 14y ago
Exactly - "Things are necessarily crappier on the web, of course." I wonder, though. Could there be a "code has changed" warning from the client? I mean, authentication should be pretty damn stable, and maybe even universal. If someone does modify the page, it'd be nice to know if that change was reflected on other sites, and it'd be nice to know that someone I trust had signed off on it (cryptographically). A simple alternative is to build it into browsers. A password field could generate a salt per-domain and automatically encrypt any queries to password-fields. The server doesn't even need to know about it. You'd have to be more than a little careful building it, obviously, and you'd have to find a way to deal with passwords used on more than one site, but it could work.

Retric 14y ago

Sending a hash is no different than sending a plain text password. Because the attacker has complete control at their end and can just hack a client that sends that same hash even if they don't know the original password.

monkeyfacebag 14y ago
Would it not be an aid to users in cases where they are reusing the same password on multiple sites?