News for hackers. Stuff that matters.
Re:Login Forms Over HTTPS, Please by cyphar on Friday January 29, 2016 @09:17AM (#10995253)
> Use https. And don't do client-side hashing, it's no improvement.

Well, it's an improvement if your users are reusing their passwords. Then multiple different sites will have different hashes sent.

But that's all besides the point, we should've been using zero knowledge proofs for authentication since the beginning.

Re:Login Forms Over HTTPS, Please by kqr on Friday January 29, 2016 @10:29AM (#10995704)
With HTTPS, multiple different sites will have different "hashes" sent anyway, so no, it's not an improvement over just good ol' HTTPS.
Re:Login Forms Over HTTPS, Please by cyphar on Saturday January 30, 2016 @12:30AM (#11000673)
Well, sure. But then you have to worry about how well the website is storing your passwords. Meh, password managers are the way to go to be honest.
Re:Login Forms Over HTTPS, Please by dh997 on Monday February 08, 2016 @08:57AM (#11058067)
Most websites with any sense dont store actual passwords, they usually store salted PBKDF hashed that are compared in constant time.