News for hackers. Stuff that matters.

A comment on Ebay posts every character a user types into the password box. Parent comment

Re:Ebay posts every character a user types into the password... by xigency on Wednesday June 29, 2016 @12:42PM (#12002819)
Right, but if a hacker releases a password dump for site X, no one has your password in plaintext, just the log in hash. That said, that solution requires JavaScript.
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by kstrauser on Wednesday June 29, 2016 @02:43PM (#12003683)
Yes, but then the attacker can ignore your JavaScript and just send the hash value they got from the dump. If you calculate hash(password) and send that for comparison to the hashed password stored in the user database, then hash(password) is your password from then on.
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by mabbo on Thursday June 30, 2016 @11:26PM (#12013690)
Yes, but they can't then use the dumped passwords on 300 other websites.
[ Parent | on HN ]