Linked Questions

2
votes
1answer
461 views

Should I client hash user and password, HTTPS to password_hash on PHP/MySQL server?

Following on from my earlier question Do I enhance security by appending all passwords with a fixed long string? I believe I can use PHP password_hash function with bcrypt on my server. Two questions....
2
votes
1answer
2k views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the previous/...
1
vote
1answer
54 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
1
vote
1answer
1k views

Web App encrypting data on client with login password?

I'm writing a web app for Personal Information Management that runs in the Cloud. For that I'm considering client-side encryption using AES256 with window.crypto and SJCL as fall-back for older ...
0
votes
1answer
236 views

Login Password not encrypted [duplicate]

So, I was just playing with BurpSuite when I found something I didn't understand. When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
0
votes
1answer
66 views

Secure custom API [duplicate]

I create desktop client for one e-shop and this client will use some functions using e-shop's API, like: GetOrders UpdateOrder SetOrder etc... I'm creating custom authentication for that client, but ...
0
votes
1answer
2k views

If I use SSL, do I need to hash the password before sending it to the server? [duplicate]

I am setting up a website to help people with certain niche interests find each other. It is being done purely as a voluntary project, there is no money involved (on either side), nor is there much ...
0
votes
1answer
122 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
0
votes
1answer
726 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
-1
votes
1answer
936 views

Send hash password or send password to hash in server? [duplicate]

Im doing a little research in my question but no found any concrete answer. I have a client-server architecture. Im using Bcrypt as hash function (the password its store as double hash), and HTTPS to ...
1
vote
0answers
70 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...
1
vote
0answers
93 views

How do Google, Microsoft and Yahoo mask or hash passwords on the client side?

I'm making recommendations to improve our user authentication (login). Our approach thus far is to ensure we (and libraries we use) are following all of the the OWASP guidelines. I have also been ...
1
vote
0answers
528 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
0
votes
0answers
50 views

Is client-side password hashing still useful when using TLS? Is TLS crackable? What about PFS? [duplicate]

Is client-side password hashing still necessary / useful when using TLS? What about TLS protocols with PFS (perfect forward secrecy) like Diffie-Hellman? Let’s say that I’m running a web application ...
0
votes
0answers
25 views

Does limiting the length of a password help prevent DoS attacks? [duplicate]

I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...

15 30 50 per page