News for hackers. Stuff that matters.

A comment on Digital Identity Guidelines: Public Comment Period. Parent comment

Re:Digital Identity Guidelines: Public Comment Period by hvidgaard on Monday March 13, 2017 @06:14AM (#13856538)
The difference is that I can verify the code, and the data send. If I send the password to serverside hashing, I can only trust the server to handle it correctly. Security wise that is a fairly important difference.
[ Parent | on HN ]
Re:Digital Identity Guidelines: Public Comment Period by temprature on Monday March 13, 2017 @07:22AM (#13856812)
Are you saying you not only know of some website that does password hashing client-side but that you also inspect the javascript that site serves you every time you login?
[ Parent | on HN ]
Re:Digital Identity Guidelines: Public Comment Period by hvidgaard on Monday March 13, 2017 @08:27AM (#13857144)
Security wise there is a difference. This difference don't matter to the average person. I don't reuse passwords, so I don't need this protection.
[ Parent | on HN ]