Linked Questions

4
votes
1answer
3k views

Hash, salt and best practices [duplicate]

Reading about hashing, salt and pepper, I can't get my head around the following scenario: If there's a web application and you register on that site, should the password be hashed on the client or ...
-2
votes
1answer
484 views

Digest authentication - client side [duplicate]

Possible Duplicate: Client side password hashing How one design support for digest authentication in client side. HTML form probably won't help. Does one need javascript and set the header ...
1
vote
2answers
272 views

Why are passwords not locally hashed aditionally? [duplicate]

People are reusing passwords all the time, and with many sites accepting email addresses as logins, a stolen password can potentially unlock many accounts. So why not just hash the password locally ...
2
votes
3answers
124 views

What to do about compromised passwords through malicious sites or site hacks [duplicate]

So my question or hypothesis is that: most people use only a few passwords for all online services, getting one of these passwords means you could access that person's sites easily which don't have ...
0
votes
0answers
165 views

MD5 Bcrypt best practice [duplicate]

I'm currently storing bcrypt encrypted passwords in my database. At the moment my html forms submit a clear text password to my server, which then compares the bcrypt result (of the clear text) for a ...
-1
votes
0answers
84 views

Do large companies like Google have users hash their passwords client-side? [duplicate]

What I am asking is does big tech companies like google have new users to hash their passwords on their browsers before it is sent to the back end? Do users send their password in plain text then the ...
1
vote
0answers
23 views

What is better way of transmitting password input? Plaintext or its hash value? [duplicate]

Let's just say there is a client and a server. The end-user inputs his/her password in the client interface. Then the data will be sent to the server for validation. In terms of security, would it be ...
0
votes
0answers
19 views

Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]

Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server? For example when dealing with open source projects where users can self-host their ...
891
votes
13answers
278k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
136
votes
10answers
76k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
95
votes
11answers
63k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
60
votes
12answers
43k views

How long should the maximum password length be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
52
votes
5answers
11k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...
28
votes
5answers
6k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
13
votes
5answers
3k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...

15 30 50 per page