I'm currently setting up a basic username & hash based login process for a web application. The process consist of the following steps:
- User submits their username.
- Server responds with salt.
- User hashes the password and sends it and the username to the server.
- Server authenticates the user.
Obviously this is somewhat simplified and multiple steps during the actual hashing process is glossed over.
What I see here is a potential of enumerating existing usernames. If an attacker submits a non existing username - no salt will be provided, hinting the attacker whether or not the username is in use.
When a non existing username is provided, if I were to provide a random salt, does it prevent the attacker from enumerating the existing users?
Would such a precosion be so minor it might as well be skipped?
- An attacker could see that the server is just spewing out random values.