-1

This question already has an answer here:

Im doing a little research in my question but no found any concrete answer. I have a client-server architecture. Im using Bcrypt as hash function (the password its store as double hash), and HTTPS to protect the channel.

Lets suppose my client is performing login. Im using nounces for One-Time-Password login.

Should i do the Hash(password) at client side and send it to server to validate? Or just send the clean text password through the HTTPS and do at server side Hash(password) and validate it?

marked as duplicate by Stephane, martinstoeckli, Mike Ounsworth, Community Sep 27 '17 at 13:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    What do you mean by "the password its store as double hash"? – Jacco Sep 27 '17 at 11:15
  • @Jacco, double time hash = Hash(Hash(password)) – rew1nd Sep 27 '17 at 13:32
2

You should send the plain text password (over HTTPS) and do the hashing on the server side.

If you would do the hashing before sending it to the server, the hash of the password effectively became the password, because an attacker would only need to know the hash of the password to successfully authenticate with the server.

See also: https security - should password be hashed server-side or client-side?

  • 1
    why duplicating the answer instead of voting to close as duplicate ? – Tensibai Sep 27 '17 at 12:01
  • @Tensibai, because I first typed out the answer, then noticed the related link and thought it nice to add extra attention to it, so I edited the answer and included it. – Jacco Sep 27 '17 at 16:08
  • Fair enough, I had more VTC with the link at the same time personally. – Tensibai Sep 28 '17 at 7:57
  • Please don't do this. If you send the plaintext password, how is that worse than sending a hash which is 'effectively' the password?! The password IS the password! You should get the server to send a one-time nonce and/or salt to combine with the password - hash that - and send that to the server, which is only valid for that one request – Milney Mar 7 at 16:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.