Linked Questions

27
votes
5answers
5k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
9
votes
3answers
5k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
16
votes
3answers
20k views

Is it ok to send plain-text password over HTTPS? [duplicate]

I understand why the password should be salted and hashed before being saved into the database, but my question is if it needs to be hashed on the browser side or just sending plain-text password over ...
8
votes
4answers
22k views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With HTTPS,...
9
votes
3answers
2k views

Hashing Password on Client Side to avoid lag on single-core game server? [duplicate]

I am currently implementing a simple login system. I would like to securely store all the user passwords in my database. The passwords are the most important components. All the other user data is not ...
-2
votes
2answers
10k views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
6
votes
2answers
1k views

Can you encrypt a password using that password itself? [duplicate]

Possible Duplicate: How to securely hash passwords? https security - should password be hashed server-side or client-side? I need to make a request to a web server, the only information I have ...
2
votes
1answer
2k views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the previous/...
3
votes
2answers
396 views

Why are passwords sent unhashed by most modern websites? [duplicate]

I've been investigating various protocols used to send usernames and passwords to web servers in order to authenticate, and while obviously all of them these days use SSL/TLS, I was a bit surprised to ...
0
votes
1answer
2k views

If I use SSL, do I need to hash the password before sending it to the server? [duplicate]

I am setting up a website to help people with certain niche interests find each other. It is being done purely as a voluntary project, there is no money involved (on either side), nor is there much ...
0
votes
1answer
683 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
2
votes
3answers
234 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
-1
votes
1answer
781 views

Send hash password or send password to hash in server? [duplicate]

Im doing a little research in my question but no found any concrete answer. I have a client-server architecture. Im using Bcrypt as hash function (the password its store as double hash), and HTTPS to ...
0
votes
5answers
156 views

Are users meant to hash their passwords? [duplicate]

When a user logs into their account on my server, should they send their raw data to me, and then I bcrypt compare them, or are they supposed to hash and and I directly compare? I ask this because ...
-1
votes
2answers
481 views

Hashing User Passwords Client or Server side [duplicate]

I am a university student and I have only now reached the part of my degree where we focus on security. The task was very broad in how we were to protect our database and user details. All it said was ...

15 30 50 per page