Digital Identity Guidelines: Public Comment Period

Re:Digital Identity Guidelines: Public Comment Period by thegreatpl on Monday March 13, 2017 @05:30AM (#13856372)

Actually, Passwords should never be hashed client side. Otherwise, a man in a middle attack could intercept the hash and get your password, allowing them to log in. Instead, the password should be encrypted to the server, and hashed there.

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by hvidgaard on Monday March 13, 2017 @05:38AM (#13856398)

If a MitM attack can get my hash, what do you think they can get if I send the password to be hashed by the server?

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by grey-area on Monday March 13, 2017 @08:19AM (#13857091)

So what does your hash add?

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by hvidgaard on Monday March 13, 2017 @08:25AM (#13857128)

Verifiable protection against data breaches.

[ Parent | on HN ]