Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have:
Username: sapi ✓
Password: passw ×
and by the time I've finished typing, the site already lets me know that there were no mistakes:
Username: sapi ✓
Password: password123 ✓
Submission of the form is still required to actually log on.
Let's assume that this is not done on the client side (eg, by informing the client of the hashing algorithm and target hash); such an approach would obviously be unsafe, as it would allow you to obtain an arbitrary user's hash.
Assuming that the communication is encrypted, can checking the password letter by letter as it is typed pose a security risk?
My main area for concern is that doing so involves repeatedly transmitting similar (sub)strings:
- some overhead data + the first letter of the password
- some overhead data + the second letter of the password
- ...
- some overhead data + the entire password
This makes the plaintext of each communication to some extent deterministic (or at least, related to that of the previous and next communications).
I know that some encryption algorithms are vulnerable to known-plaintext attacks, although I'm not sure if SSL is one of them. I also don't know whether the level of knowledge gained here (which is obviously much less than for a known-plaintext attack) is sufficient to decrease the entropy of the output.
I guess I have two questions:
- Is this a security risk with standard web encryption algorithms (basically https); and
- If not, is there a class of algorithms for which this might pose problems?
I've added a clarification to the question that I'm referring to a login form, not a registration form. In other words, the client cannot simply validate the password against known length/complexity rules using JS; the account already exists and the checkmark only appears for a correct password.