3 ms·
Intercepting the plaintext of the communications to the server isn't sufficient since the password is sent to the server after being hashed and the plaintext is
by absherwin 13y ago
Intercepting the plaintext of the communications to the server isn't sufficient since the password is sent to the server after being hashed and the plaintext is encrypted. It may provide the basis for an attack but in itself it doesn't break the second layer of security.
Ironically, this is an advantage of having a second layer of cryptography in the browser. It forces an attacker to do significantly more work to acquire the data passively or requires an active attack.
- j0ev 13y agoUsing his same attack, it's easy to spoof the js crypto libs to be insecure/have a backdoor, while the site appears unmodified to the user. Even worse is that the attacker only really needs to spoof the JS assets once, and set an extremely long expiration date in the response cache headers, and then he's poisoned your site until the user forces a reload or kills his cache. tldr; you owe mox $1000