Linked Questions

-1
votes
1answer
942 views

Send hash password or send password to hash in server? [duplicate]

Im doing a little research in my question but no found any concrete answer. I have a client-server architecture. Im using Bcrypt as hash function (the password its store as double hash), and HTTPS to ...
0
votes
1answer
2k views

If I use SSL, do I need to hash the password before sending it to the server? [duplicate]

I am setting up a website to help people with certain niche interests find each other. It is being done purely as a voluntary project, there is no money involved (on either side), nor is there much ...
1
vote
1answer
1k views

Web App encrypting data on client with login password?

I'm writing a web app for Personal Information Management that runs in the Cloud. For that I'm considering client-side encryption using AES256 with window.crypto and SJCL as fall-back for older ...
9
votes
3answers
2k views

Hashing Password on Client Side to avoid lag on single-core game server? [duplicate]

I am currently implementing a simple login system. I would like to securely store all the user passwords in my database. The passwords are the most important components. All the other user data is not ...
2
votes
1answer
88 views

Would client side hashing provide security from a comprised server [duplicate]

I've been reading about hashing and encryption so I can make more informed decisions. I already know the benefits of ssl and password hashing serverside as best practises. However I was wondering, ...
0
votes
4answers
160 views

Are users meant to hash their passwords? [duplicate]

When a user logs into their account on my server, should they send their raw data to me, and then I bcrypt compare them, or are they supposed to hash and and I directly compare? I ask this because ...
2
votes
1answer
461 views

Should I client hash user and password, HTTPS to password_hash on PHP/MySQL server?

Following on from my earlier question Do I enhance security by appending all passwords with a fixed long string? I believe I can use PHP password_hash function with bcrypt on my server. Two questions....
0
votes
1answer
122 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
27
votes
5answers
5k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
9
votes
3answers
5k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
1
vote
0answers
529 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
-1
votes
2answers
11k views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
2
votes
3answers
248 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
9
votes
4answers
25k views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With HTTPS,...
19
votes
3answers
24k views

Is it ok to send plain-text password over HTTPS? [duplicate]

I understand why the password should be salted and hashed before being saved into the database, but my question is if it needs to be hashed on the browser side or just sending plain-text password over ...

15 30 50 per page