0

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and I expected hashes to be identical but they are not.

My intention was to hash password in HTTP request body and only compare the strings on server side. Does it makes sense from security point of view?

2

My intention was to hash password in HTTP request body and only compare the strings on server side. Does it makes sense from security point of view?

Not really. While it makes it harder for someone to gain the clear text password, they don't have to. But an attacker won't have to care about the password. They can pass the hash. The hash is effectively the password, stored in clear text, in this scenario!

If users are perfect, and use unique, strong password, this would be equal to storing the passwords in clear text. As users are not perfect, and reuse passwords, it'd be a bit better than storing them in cleartext in real life. But not for your application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.