Ebay posts every character a user types into the password box

Re:Ebay posts every character a user types into the password... by ncallaway on Wednesday June 29, 2016 @09:47AM (#12001577)

No, it's more about leaking information to the JS client. If, for example, their password verification rules stipulate that you can't reuse any of your last N passwords, then they would need to make this check server-side as they don't want to provide that information to the client.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by czinck on Wednesday June 29, 2016 @09:51AM (#12001599)

Which sending a POST on every keystroke won't really help with anyway, because they can't tell that you typing "h-u-n" will match your old password of "hunter2", assuming it's properly hashed.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by ncallaway on Wednesday June 29, 2016 @10:09AM (#12001706)

Oh, I agree. Every keystroke seems like overkill.

If I were in charge of both requirements and implementation I'd debounce the input by 300-500ms and display a "loading" spinner in the password complexity box until the debounce timer and network request had fully resolved.

I was just trying to explain why, given some business use-cases, doing password validation on the client isn't always possible.

[ Parent | on HN ]