101 reputation
bio website ericleads.com
location San Francisco, CA
visits member for 10 months
seen Oct 7 '13 at 15:55

Author: "Programming JavaScript Applications" (O'Reilly).

comment Challenging challenge: client-side password hashing and server-side password verification
Agreed. Definitely rely on SSL to protect passwords coming from the client-side. 1) Doing otherwise would require a large code payload to implement all the encryption technology you'd need to pull it off. 2) You can't trust anything that happens on the client-side anyway. Maybe you can cover a MITM case, but what about a keylogger? 3) You know server CPU power. Worry about this stuff, first: ericleads.com/2013/08/…