6

I'm developing an application that requires a user to login. On the server side I'm using the PBKDF2 algorithm to hash passwords, but currently I'm sending passwords to the server as a plain text string. Now it is prone to sniffing, but I do not know how change it. What should I do to make this more secure?

  • Have you considered not having a password at all and instead use an authentication service, perhaps linking with a Google account or something? – corsiKa Apr 6 '18 at 14:56
35

Use TLS for the connection to the server.

The purpose of securely hashing a password is to make it more difficult to attack if the database is ever stolen. It is not designed to prevent sniffing the plaintext password. In order to securely communicate with the server over a hostile medium, you should be using TLS. This will prevent interception on the wire, while the server-side PBKDF2 will prevent the password from being trivially recovered from the contents of a stolen database.

You might be tempted to additionally hash it client-side. Unfortunately, that would not prevent an attacker from recording the hash being sent from the client and using it to log in later. TLS provides protection for a large number of threat models, and explicitly takes into account this issue. It will prevent an attacker from simply replaying whatever credentials you are using. The only scenario when client-side hashing would be beneficial is if the server is hostile but the server has no control over the code that the client executes, or if the server is too low-powered to perform a proper slow KDF and some heavy processing must be offloaded to the client. Either way, you should use TLS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.