News for hackers. Stuff that matters.

A comment on Ebay posts every character a user types into the password box. Parent comment

Re:Ebay posts every character a user types into the password... by mabbo on Wednesday June 29, 2016 @11:52AM (#12002468)
Do your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this password was already used, etc).
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by whiskeySix on Wednesday June 29, 2016 @12:09PM (#12002584)
any clientside validation can easily be bypassed using something like fiddler.
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by FabHK on Wednesday June 29, 2016 @07:50PM (#12005711)
Password strength checking is (properly understood, in my view) providing help to the user, not enforcing some silly and annoying "password validation" rules.
[ Parent | on HN ]