Tag Info

New answers tagged

0

What would be a disadvantage to this approach compared to standard approach with transmitting plaintext password over the internet and then hashing and storing it on the server? Users who use multiple computers, some with JavaScript turned on and some with JavaScript turned off, would be unable to authenticate from some of their computers and may not ...


1

In your scheme, you are substituting the password by it's hash. The hash becomes the password. An attacker who is able to sniff the hash can authenticate to your server with it without knowing the password. The attacker just has to craft a correct HTTP request and send it to your server, or edit the javascript of your login webpage in his own browser to ...


1

There isn't so much a disadvantage of using javascript to hash the password, but there is little advantage. This does provide protection against a passive capture, but doesn't offer any more security over SSL. Attacker has an Active MiTM or has control of server In the case the attacker can Man in The Middle a connection between client and server, the ...


0

Trusting the server is unavoidable, and you have to trust the server anyway if the crypto is server based. MITM attacks also apply to server based crypto, and I see no reason why a malicious plugin couldn't also attack server based crypto. The main difference is that you're relying on the client end to do the encryption, where you have less control of the ...


1

What you are proposing is the same architecture that is used in online password managers like Lastpass and online Bitcoin wallets like Blockchain. You have named the two big threats: Javascript tampering and a compromised computer. You deal with the threat of Javascript tampering by securing the server and convincing the users that your Javascript is ...


-1

This is a great question, because it highlights the importance of one of the three fundamental requirements of any secure protocol, i.e. integrity. (For the record, the other two fundamental requirements are secrecy and authenticity). The goal of integrity is to prevent a man in the middle from altering the content of a message en route from the sender ...


1

"Would it be possible for the attacker to change this packet before reaching its destination and modify it telling instead that I´ve got 0 health and then send to the server with modified values" They could intercept and alter the packet easily, but forwarding the altered packet to the server without the server knowing it's come from another user is the ...


1

Yes, it's perfectly possible. The answer is to use encrypted connections, since encryption protocols such as TLS/SSL and SSH will stop the attacker from seeing what's in the packets, and also allow the server to detect and reject any changes from what was sent by the client.



Top 50 recent answers are included