3 ms·
Let's see how long it takes the hacker news team to fix! (Or even some lisp hackers to beat pg with their own patch!) Three main issues: 1) improper use of ha
by illumen 17y ago
Let's see how long it takes the hacker news team to fix!
(Or even some lisp hackers to beat pg with their own patch!)
Three main issues:
1) improper use of hashing. No salt used.
2) sha1 is not the best hash to be using.
3) passwords are not encrypted in the browser. So are sent clear text.
Fixes for issues one and two, are covered in the article...
For issue 3), you can do the hash+salt client side (with js) if SSL isn't feasible.
cu.
- rythie 17y agoIf you do hash+salt client side, then the final hash is your password essentially, which will be sent in the clear. Anyone sniff the already hashed password to login to your HN account without knowing your actual password. What you didn't say but might have implied is: If you have the server challenge the client with a different salt each time it would fix the problem. Of course SSL also tells you the you are talking to the real server, challenge response doesn't really help that, nor does it stop some stealing your session id and posting as you.