3 ms·
Can you explain what you feel is foolish about encrypting passwords on top of SSL?
by furyofantares 14y ago
Can you explain what you feel is foolish about encrypting passwords on top of SSL?
- codexon 14y agoIf your SSL is compromised, the attacker can insert javascript to send the unencrypted password somewhere else. That is why security experts like tpacek have repeatedly said js encryption schemes aren't secure.
- furyofantares 14y agoWhy do you say an SSL compromise necessarily means the attacker can manipulate the connection? And what about a promise between the SSL endpoint and the database?