Tweeted twitter.com/#!/StackSecurity/status/144557506067308544
3 added 94 characters in body
source | link

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Update1: The scenario is everyday usage of internet sites. I know that servers "should hash passwords" and "users should different passwords" but this is simply not a realistic situation. @Password-safes: what if you're on the go? @Different passwords for every site: unrealistic

Related answers:

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Update1: The scenario is everyday usage of internet sites. I know that servers "should hash passwords" and "users should different passwords" but this is simply not a realistic situation.

Related answers:

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Update1: The scenario is everyday usage of internet sites. I know that servers "should hash passwords" and "users should different passwords" but this is simply not a realistic situation. @Password-safes: what if you're on the go? @Different passwords for every site: unrealistic

Related answers:

2 actual situation
source | link

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Update1: The scenario is everyday usage of internet sites. I know that servers "should hash passwords" and "users should different passwords" but this is simply not a realistic situation.

Related answers:

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Related answers:

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Update1: The scenario is everyday usage of internet sites. I know that servers "should hash passwords" and "users should different passwords" but this is simply not a realistic situation.

Related answers:

1
source | link

How to guarantee that password is hashed on server-side?

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available in cleartext and can be used on other sites.

Is there any mechanism that guarantees that the password is hashed before reaching the server-side making it unique to the server, like additionally hashing it on the client-side? Which seed would be used then to be able to reconstruct the same hash, without the server/attacker knowing the seed too?

Related answers: