Linked Questions

-1
votes
1answer
49 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
0
votes
1answer
97 views

How can I create a secure auto-login? (java)

I am writing a server-client program. When a new user installs the program and opens it for the first time, he has to enter a password. The password in combination with an email address is needed to ...
0
votes
0answers
80 views

Why server side hashing is required if the client side hashing is already in place?

I am looking for best practice for username/password login. People have different views for client side hashing on password. From Google's recommendation https://cloud.google.com/solutions/modern-...
1
vote
1answer
143 views

Bank client android app authentication security

I'm currently developing an android bank client app. Obviously security is key here. The app sends requests over HTTPS TLSv1.2 to my java server. What I currently have in mind Login The app asks ...
1
vote
1answer
79 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
0
votes
0answers
56 views

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...
1
vote
3answers
215 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
3answers
72 views

How to make the first request which used to create account safe? [duplicate]

To authorize user, our application defined below steps: Send user email and password (plain text) through HTTPS. When server received it, generate a salt to hash password and store it. When user ...
0
votes
1answer
483 views

Login Password not encrypted [duplicate]

So, I was just playing with BurpSuite when I found something I didn't understand. When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
27
votes
9answers
16k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
2
votes
4answers
182 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
0
votes
1answer
76 views

Secure custom API [duplicate]

I create desktop client for one e-shop and this client will use some functions using e-shop's API, like: GetOrders UpdateOrder SetOrder etc... I'm creating custom authentication for that client, but ...
-1
votes
2answers
812 views

Hashing User Passwords Client or Server side [duplicate]

I am a university student and I have only now reached the part of my degree where we focus on security. The task was very broad in how we were to protect our database and user details. All it said was ...
1
vote
0answers
73 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
1
vote
3answers
593 views

Benefits to client-side password hashing on top of other security mechanisms [duplicate]

We live in a world where password reuse is common and most of the internet users are not using password managers, while hacks and breaches are becoming more common. The importance of those breaches ...

15 30 50 per page