Linked Questions

0
votes
0answers
47 views

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...
1
vote
3answers
195 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
3answers
70 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
0
votes
1answer
176 views

Login Password not encrypted [duplicate]

So, I was just playing with BurpSuite when I found something I didn't understand. When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
0
votes
0answers
25 views

Does limiting the length of a password help prevent DoS attacks? [duplicate]

I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...
16
votes
3answers
21k views

Is it ok to send plain-text password over HTTPS? [duplicate]

I understand why the password should be salted and hashed before being saved into the database, but my question is if it needs to be hashed on the browser side or just sending plain-text password over ...
29
votes
7answers
10k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
27
votes
10answers
12k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
2
votes
4answers
166 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
0
votes
1answer
65 views

Secure custom API [duplicate]

I create desktop client for one e-shop and this client will use some functions using e-shop's API, like: GetOrders UpdateOrder SetOrder etc... I'm creating custom authentication for that client, but ...
-1
votes
2answers
507 views

Hashing User Passwords Client or Server side [duplicate]

I am a university student and I have only now reached the part of my degree where we focus on security. The task was very broad in how we were to protect our database and user details. All it said was ...
1
vote
0answers
70 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
4
votes
4answers
2k views

Brute force prevention: where and when?

I design a 'secure' login system. Let's focus in the brute force prevention. In my Android client I have a counter that counts the number of times that the user tries to login, with false credentials. ...
1
vote
3answers
514 views

Benefits to client-side password hashing on top of other security mechanisms [duplicate]

We live in a world where password reuse is common and most of the internet users are not using password managers, while hacks and breaches are becoming more common. The importance of those breaches ...
3
votes
2answers
432 views

Why are passwords sent unhashed by most modern websites? [duplicate]

I've been investigating various protocols used to send usernames and passwords to web servers in order to authenticate, and while obviously all of them these days use SSL/TLS, I was a bit surprised to ...

15 30 50 per page