Tag Info

New answers tagged

0

Hashing of the password prior to transmission happens for some authentication protocols, most notably the WAP/WPA2 PSK four way handshake. In this scenario, the WPA protocol needs to prevent against a masquerade attack, such that a rogue AP cannot obtain the plaintext password when prompting clients for authentication. In this protocol, an attacker who ...


0

There are no theoretical benefits from hashing client-side and server-side to hashing twice server-side ; unless the connection between the client and server cannot be trusted. However in practice, I have seen multiple instances where plain-text passwords ended-up in logs (mostly in error logs). In this particular scenario it has a clear advantage. I ...


3

There are no standard ways around, but there are ways around. What exactly you have to do to get around will depend on the browser and on the version. On this link you can find some examples to get around the protection in Google Chrome: http://blog.securitee.org/?p=37 The precondition on the examples at this blog post is that there are two GET parameters ...


3

XSS attacks are still possible now, for this you can go through OWASP's Top 10 Vulnerabilities Project 2013, which is still a top 3 vulnerability. But today modern browsers are very keen with XSS and Same-origin-policy eventhough your website has no protection to this attacks. In case of XSS every browsers are updated with XSS Filters in their newer ...


4

bcrypt is not meant for this type of client-side hashing A key property of bcrypt is that, when run two independent times with the same plaintext, most implementations will produce different hashes. This is due to the use of a salt, which is designed to make it difficult to see if two different users have the same password. In contrast, login forms need to ...


4

Since you seem committed to implement this guideline, I'll directly answer your question. But understand that BCrypt and MD5 are vastly different. BCrypt deliberately does substantial work, while MD5 does considerably less, so you're going to need to deal with promises: <!-- https://github.com/nevins-b/javascript-bcrypt --> <script ...


22

You have no security without authentication Just to explain it further, I am using JCryption API for encrypting the password using AES, so the value transmitted over network is AES(SHA1(MD5(plain password))) now I want to replace MD5 with Bcrypt only. Rest of the things remain unchanged. This approach works even against "Man in the middle ...


33

I know HTTPS can solve the problem, but I am still instructed to encode the password before sending it over network as per our organizational guidelines. This really defines your situation. Basically, you have a simple solution that you should use anyway (use HTTPS), if only because without HTTPS an active attacker could hijack the connection after the ...


9

The best solution is: don't. If you're sending the passwords over HTTPS, hashing them provides no additional security. If you're sending the passwords over plain HTTP, an attacker can grab the hashed password and use it to log in themselves; alternatively, they can tamper with the JavaScript to send the password to them before hashing. In either case, ...



Top 50 recent answers are included