Linked Questions

-2
votes
3answers
2k views

Is it useful to hash the password before sending to server for authentication? [duplicate]

In the design of a backend database, the password field suppose to be hashed using bcrypt. There are two approaches backend only: password = bcrypt(plain_passsword) frontend + backend = password = ...
0
votes
0answers
59 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
63
votes
8answers
18k views

My bank support just asked me for my online banking credentials

As title says, I was asked for my online banking password while on the process of getting in touch with a real person. This is something I'd never do and knowing that the call was being recorded (for ...
33
votes
7answers
12k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
11
votes
4answers
12k views

Is encryption of passwords needed for an HTTPS website? [duplicate]

I am in a bit of confusion as we have been asked to AES encrypt passwords before sending it to the server. The whole website communicates over HTTPS with the server and uses secure cookies. AFAIK, ...
30
votes
2answers
3k views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
2
votes
1answer
2k views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the previous/...
1
vote
2answers
3k views

BCrypt password hashing with user email as salt?

I'm using dcodeIO/bcrypt.js to hash user password on login before sending it to the server. On the server-side I then hash this again and compare with the doubly hashed stored password. The question: ...
4
votes
1answer
3k views

Hash, salt and best practices [duplicate]

Reading about hashing, salt and pepper, I can't get my head around the following scenario: If there's a web application and you register on that site, should the password be hashed on the client or ...
0
votes
4answers
162 views

Are users meant to hash their passwords? [duplicate]

When a user logs into their account on my server, should they send their raw data to me, and then I bcrypt compare them, or are they supposed to hash and and I directly compare? I ask this because ...
0
votes
4answers
138 views

Does TLS hash passwords before encrypting?

Suppose I am logging into Gmail by giving my credentials. Does my plaintext get encrypted or is it first converted to the hash and the hash encrypted? And also if I am communicating to the bank web ...
1
vote
1answer
94 views

Why is the password field blanked in the registration form if the validation fail? [duplicate]

Is it really a problem if you send back the password when the validation fail on a registration form? I understand that the html that is sent back could be cached on the computer of the person ...