Linked Questions

4 votes
1 answer

Hash, salt and best practices [duplicate]

Reading about hashing, salt and pepper, I can't get my head around the following scenario: If there's a web application and you register on that site, should the password be hashed on the client or ...
N. Groß's user avatar
3 votes
2 answers

Should one encrypt traffic even when using HTTPS? [duplicate]

I took a look at google and here and I coudn't find the answer to this question: Let's say that I have a Webservice and an Android app. They communicate over HTTPS. Should I encrypt traffic or I can ...
luizfzs's user avatar
  • 291
0 votes
2 answers

Hashing sensitive data in request [duplicate]

We have set the https connection, between the client and server. The problem is that security guys, showed us it is possible to intercept the data using rogue invalid certificate (user must accept it ...
Remiwaw's user avatar
-1 votes
1 answer

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
user3689598's user avatar
2 votes
0 answers

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
Bufke's user avatar
  • 183
-1 votes
1 answer

Is There Any Real Benefit To Encrypting A Password Before Sending Over SSL [duplicate]

If my application is sending credentials to an auth server over https, is there any real benefit of encrypting it (using RSA for example) before sending it to the auth server? Or is the benefit so ...
yitzih's user avatar
  • 283
0 votes
0 answers

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...
Char Star's user avatar
  • 113
8 votes
4 answers

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
John's user avatar
  • 2,282
4 votes
3 answers

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
Mikko Rantalainen's user avatar
0 votes
1 answer

Sending server side credentials as plaintext after connecting to SSL [duplicate]

I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice? The application ...
Mohammed Farhan's user avatar