Ebay posts every character a user types into the password box

Re:Ebay posts every character a user types into the password... by zip1234 on Wednesday June 29, 2016 @11:43AM (#12002396)

Hashing it on the client side doesn't really have any positive effect on security as the client must then know what salt is used for the hash. This is less secure than just hashing on the server as the salt and number of hash iterations is then unknown by the client (or potential attackers).

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by mabbo on Wednesday June 29, 2016 @11:50AM (#12002454)

I disagree.

Whatever the server receives, it should do all the good things, salted hashing and what-have-you. But no one says what it receives needs to be a plaintext password.

Hash on the client side before sending- unsalted, or salt there as well and pass it along to the server- but let's just ensure that the server never has the ability to see a plaintext password. It can't log it, it can't accidentally leak the plaintext.

Will that solve all problems? Oh, hell no. But it at least strengthens the mitigation against certain attacks or mistakes.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by phs2501 on Wednesday June 29, 2016 @12:02PM (#12002534)

If you hash, with or without salt, on the client for changing the password, you'll also need to hash identically when checking it (i.e. for login). In effect, the hash becomes the password; even if the plaintext is never leaked the first-level hash is just as good for access.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by mabbo on Thursday June 30, 2016 @11:25PM (#12013688)

Yes. I agree. My point is I don't want to ever see plaintext on the server in any form. It won't stop everything, but it's still worth doing.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by xigency on Wednesday June 29, 2016 @12:42PM (#12002819)

Right, but if a hacker releases a password dump for site X, no one has your password in plaintext, just the log in hash. That said, that solution requires JavaScript.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by kstrauser on Wednesday June 29, 2016 @02:43PM (#12003683)

Yes, but then the attacker can ignore your JavaScript and just send the hash value they got from the dump. If you calculate hash(password) and send that for comparison to the hashed password stored in the user database, then hash(password) is your password from then on.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by mabbo on Thursday June 30, 2016 @11:26PM (#12013690)

Yes, but they can't then use the dumped passwords on 300 other websites.

[ Parent | on HN ]

Re:Ebay posts every character a user types into the password... by TheSoftwareGuy on Wednesday June 29, 2016 @11:55AM (#12002486)

Isn't the salt not necessarily supposed to be impossible for the attacker to find out though? like isn't it usually like the username, since it needs to be different for each user but not impossible for the server to figure out?

[ Parent | on HN ]