28,015 reputation
22766
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 5 hours ago

Aug
8
reviewed Approve suggested edit on Can Tor nodes infect my computer with malware?
Aug
7
reviewed Leave Open Why after a website password reset am I asked to login again?
Aug
6
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@Falco - and a programming error could result in the hash being insecure too. You have to validate behavior of security related code, not just hope it works right. The more complexity you add to a system, the harder it is to validate and the more likely an error or vulnerability is to appear. You have to judge how much benefit you get for a given amount of additional effort. Eventually the added risk of error in implementation is not worth the minimal gain in added resistance.
Aug
6
awarded  windows
Aug
5
awarded  Good Answer
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
Password/hash conversation continued in chat.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
Ah yes, I always remember GET is a bad idea because it is visible on the client system and may end up in client history, but forget that servers may log the parameters too.
Aug
5
comment Can an individual get an extended validation certificate?
Section 8.5 of that document makes it even clearer. It lists the valid entities explicitly and an individual is not one of them.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@CodesInChaos - yeah, if you are using a sufficinently large intermediate hash and are sure it behaves well (truly random distribution) then it should be ok as long as the initial hash is salted and takes long enough to force use of a full enumeration of the intermediate hash space (or at least near full.)
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@CodesInChaos - Because nothing client side is trusted. An attacker can skip the entire slow process by bypassing the client entirely. You need to make sure you can't build a rainbow table of cheap, fast hash values. It isn't feasible if you salt each and provided the intermediate hash is long enough. Otherwise, you just make a rainbow table of hash values which can be generated at a very, VERY fast rate if they are cheap.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@CodesInChaos - I'd only go for it being slightly less bad. Even using a complex hash to make a "longer" input, it is only key extension and an attacker is going to be able to produce a lot of cheap hashes very easily. Practically, it might not matter if the client side hash output is long and there are no vulnerabilities in either hash that limit the expansion from simple values. It's also important to note that in such a case, you would need to salt both the client and server side hashes. I'm still a bit dubious of the cost vs the benefit though.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@AndyBoura - if you are designing the system such that you can support client side hashing, you have control over the network and server behavior for parts that would have access to the clear text. True, you aren't harmed by hashing it on the client (other than lost time), just so long as you it doesn't significantly impact the amount of hashing you do on the server.
Aug
4
awarded  Nice Answer
Aug
4
revised Is it safe to send clear usernames/passwords on a https connection to authenticate users?
added 63 characters in body
Aug
4
revised Is it safe to send clear usernames/passwords on a https connection to authenticate users?
added 63 characters in body
Aug
4
reviewed No Action Needed How is ZixCorp able to provide email encryption without a password?
Aug
4
reviewed Close 2 factor authentication - cost effective solution for a web startup
Aug
4
reviewed Leave Open How JavaScript malware targets browsers?
Aug
4
reviewed Close Anti Skimmer and Anti fraud?
Aug
4
reviewed Close Browser fuzzing with Windbg