My situation is this:
- User credentials are stored on the server, bcrypt, random hashes.
- I'm designing a REST API, so I'd like to keep this as stateless as possible!
- The client is an Android/iPhone app.
- All communication is done over HTTPS with newest TLS
Here are the scenarios in which I have to transmit a password over the wire:
- User logs on
- User changes his password (needs the old password for confirmation)
- User changes his email (needs the current password for confirmation)
In all of these cases I'm wondering if there would be any added security benefits in additionally hashing/encrypting the password on the client side, before sending it over HTTPS to the server.
On a related note, since the passwords are stored as hashes on the server, how would I even go about implementing an additional client side hashing/encryption schema that yields some form of the original password on the server, so that I can compare it to the stored hash?