0

Whilst I was reverse engineering what calls are performed for Sercomm H300s web panel I found out that the javascript offered for web panel performs an awkward way for username and password authentication:

  1. Firstly a challenge is received via an Ajax call.
  2. Then the random challenge is concatenated to the user provided password like this loginPWD= hex(sha256(password+challenge)). This action is performed at client-side (the browser that visits the dsl-router's web page)
  3. Then the username,loginPWD and challenge is sent back to the roputer's authentication as authentication credentials ontop of a https channel using https with self-signed certs using an Ajax Call.

But I wonder why the client (the page's javascript) to do the hassle to do the whole process of requesting a challenge and use the challenge as a salt to sha256 hash the password instead of letting the router (H300s) do the authentication via performing a traditional salted bcrypt hash checkshum check?

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.