Timeline for Is encryption of passwords needed for an HTTPS website?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 31, 2016 at 6:07 | vote | accept | Flying Gambit | ||
| Aug 10, 2016 at 13:15 | comment | added | OrangeDog | TLS is essentially a marketing name change. It's SSL v3.1+ internally. | |
| Aug 10, 2016 at 12:28 | comment | added | billc.cn | No need to discuss any encryption details here. The script used to do the encryption is downloaded via HTTPS. If the HTTPS connection is compromised, the attacker can do anything to the password. | |
| Aug 10, 2016 at 7:37 | comment | added | S.L. Barth is on codidact.com | @FlyingGambit That's what you do on the server. You also add salt. I've updated my answer, added a link to Stack Overflow's canonical question about website authentication. | |
| Aug 10, 2016 at 7:36 | history | edited | S.L. Barth is on codidact.com | CC BY-SA 3.0 |
added 253 characters in body
|
| Aug 10, 2016 at 7:33 | comment | added | Flying Gambit | Does this also mean that there is no need to take a hash of input password and compare against the existing ones in database ? | |
| Aug 10, 2016 at 7:19 | comment | added | AviD♦ | And just for completeness: Passwords need to be cryptographically protected (not encrypted - e.g. bcrypt) before storage, but that is on the server. | |
| Aug 10, 2016 at 7:13 | history | answered | S.L. Barth is on codidact.com | CC BY-SA 3.0 |