Linked Questions

4
votes
1answer
3k views

Hash, salt and best practices [duplicate]

Reading about hashing, salt and pepper, I can't get my head around the following scenario: If there's a web application and you register on that site, should the password be hashed on the client or ...
0
votes
2answers
727 views

Hashing sensitive data in request [duplicate]

We have set the https connection, between the client and server. The problem is that security guys, showed us it is possible to intercept the data using rogue invalid certificate (user must accept it ...
2
votes
2answers
333 views

Should one encrypt traffic even when using HTTPS? [duplicate]

I took a look at google and here and I coudn't find the answer to this question: Let's say that I have a Webservice and an Android app. They communicate over HTTPS. Should I encrypt traffic or I can ...
2
votes
0answers
656 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
-1
votes
1answer
305 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
0
votes
0answers
74 views

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...
-1
votes
1answer
41 views

Is There Any Real Benefit To Encrypting A Password Before Sending Over SSL [duplicate]

If my application is sending credentials to an auth server over https, is there any real benefit of encrypting it (using RSA for example) before sending it to the auth server? Or is the benefit so ...
8
votes
4answers
6k views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
3
votes
3answers
2k views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...
0
votes
1answer
84 views

Sending server side credentials as plaintext after connecting to SSL [duplicate]

I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice? The application ...