How Dropbox securely stores your passwords

Re:How Dropbox securely stores your passwords by mason55 on Wednesday September 21, 2016 @04:57PM (#12552170)

You wouldn't be able to enforce password rules. I could send my own hash of a password that wouldn't meet your password policy and you'd never know.

[ Parent | on HN ]

Re:How Dropbox securely stores your passwords by novaleaf on Wednesday September 21, 2016 @05:33PM (#12552462)

password rules are enforced client-side too. You are right that a determined person could circumvent the client-side validation, but my thinking is that if someone really wants to do this, it doesnt really hurt me any.

FYI I also do recaptcha for signup+resetpw.

[ Parent | on HN ]

Re:How Dropbox securely stores your passwords by vmasto on Wednesday September 21, 2016 @09:11PM (#12553581)

> it doesn't really hurt me any

This is the unsafe mentality of "roll your own" and it's always a bad idea. There's a reason why we have to practically blindly follow the best practices; the attack vectors are so diverse we cannot predict them.

How would you handle 3rd party phishing schemes attempting to register users with weak passwords for example?

[ Parent | on HN ]

Re:How Dropbox securely stores your passwords by novaleaf on Wednesday September 21, 2016 @11:57PM (#12554217)

As I said, I use recaptcha to prevent bots, which would also include preventing phishing.

Ultimately, if you are writing A SaaS you have to roll your own at some point, but I agree it shouldn't include things like key derivation functions.

Maybe I'm dense, but I just don't see how enforcing password strength on both the client and server is making me safer from hackers.

[ Parent | on HN ]