Linked Questions

-2 votes
3 answers
5k views

Is it useful to hash the password before sending to server for authentication? [duplicate]

In the design of a backend database, the password field suppose to be hashed using bcrypt. There are two approaches backend only: password = bcrypt(plain_passsword) frontend + backend = password = ...
Ryan's user avatar
  • 497
0 votes
0 answers
114 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
DeusXMachina's user avatar
0 votes
0 answers
88 views

Are hashed passwords transferred to a server for user authentication? [duplicate]

A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
Nihal's user avatar
  • 1
63 votes
8 answers
19k views

My bank support just asked me for my online banking credentials

As title says, I was asked for my online banking password while on the process of getting in touch with a real person. This is something I'd never do and knowing that the call was being recorded (for ...
sysfiend's user avatar
  • 2,374
38 votes
8 answers
15k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
Foy Stip's user avatar
  • 391
27 votes
6 answers
10k views

Is it safe to store a password using a secure hash followed by an insecure hash?

I'm working with some middleware that requires username/password authentication. The middleware uses MD5 hash for the password. The MD5 hash, of course, is not fit for the purpose of storing passwords....
John Wu's user avatar
  • 9,281
12 votes
4 answers
18k views

Is encryption of passwords needed for an HTTPS website? [duplicate]

I am in a bit of confusion as we have been asked to AES encrypt passwords before sending it to the server. The whole website communicates over HTTPS with the server and uses secure cookies. AFAIK, ...
Flying Gambit's user avatar
32 votes
2 answers
4k views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
paj28's user avatar
  • 33.4k
14 votes
5 answers
12k views

Hashing length for storing password

Does larger hash size improve the security? Is it overkill to use a 512-bit hash? If I stored only 256 bits of the PBKDF2-SHA512 derived key, is it less, equal or safer than 256 bits of PBKDF2-SHA256? ...
brian14708's user avatar
11 votes
4 answers
970 views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
Char Star's user avatar
  • 113
3 votes
2 answers
2k views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side -- Is it Viable?

The oft-mentioned approach for website password-handling is to use a server-side language to employ a suitable hashing algorithm (stretched or otherwise designed to overly-consume computing resources),...
Louis Jackman's user avatar
5 votes
4 answers
2k views

Secure authentication: partial client-side key stretching... please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
hbCyber's user avatar
  • 151
2 votes
1 answer
3k views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the previous/...
JD Davis's user avatar
  • 121
1 vote
2 answers
5k views

BCrypt password hashing with user email as salt?

I'm using dcodeIO/bcrypt.js to hash user password on login before sending it to the server. On the server-side I then hash this again and compare with the doubly hashed stored password. The question: ...
Andreas Zita's user avatar
4 votes
1 answer
4k views

Hash, salt and best practices [duplicate]

Reading about hashing, salt and pepper, I can't get my head around the following scenario: If there's a web application and you register on that site, should the password be hashed on the client or ...
N. Groß's user avatar

15 30 50 per page