Tagged Questions
0
votes
3answers
100 views
Why one time passwords using nested hash chain are not used?
I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
2
votes
3answers
194 views
Client-Side Hashing to decrease value of password guessing heuristics
Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here.
I'd like to do something to mitigate the affect on the community as a whole when my ...
6
votes
6answers
678 views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
1
vote
1answer
71 views
How to verify that a clientside-generated object is genuine?
I know that general best-practice states not to trust anything generated by the client.
With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
1
vote
4answers
291 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
6
votes
2answers
469 views
Is it better to hash n*x times in sha1 or n times in sha512 on the client side?
I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
