Whilst I was reverse engineering what calls are performed for Sercomm H300s web panel I found out that the javascript offered for web panel performs an awkward way for username and password authentication:

  1. Firstly a challenge is received via an Ajax call.
  2. Then the random challenge is concatenated to the user provided password like this loginPWD= hex(sha256(password+challenge)). This action is performed at client-side (the browser that visits the dsl-router's web page)
  3. Then the username,loginPWD and challenge is sent back to the roputer's authentication as authentication credentials ontop of a https channel using https with self-signed certs using an Ajax Call.

But I wonder why the client (the page's javascript) to do the hassle to do the whole process of requesting a challenge and use the challenge as a salt to sha256 hash the password instead of letting the router (H300s) do the authentication via performing a traditional salted bcrypt hash checkshum check?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.