News for hackers. Stuff that matters.
Re:Let them paste passwords by wapz on Friday May 19, 2017 @12:55AM (#14373123)
Aren't passwords hashed on the client side before sending it across the network? That would make your way around not work (unless that's done on the client side also after verifying from the server that it's correct).
Re:Let them paste passwords by rypskar on Friday May 19, 2017 @06:38AM (#14374319)
Hashing it on the client side will make the hash the password. So the stored hash can be used as password by turning off the client side hashing, for instance by turning off javascript. You use https to avoid sending the password in cleartext over the network
Re:Let them paste passwords by matthewmacleod on Friday May 19, 2017 @03:58AM (#14373683)
I've certainly never encountered a web app that hashes locally before sending. I suppose it could work if this was at the account creation or password management stages, but you couldn't implement it at the login stage for obvious reasons.

I'm having trouble imagining what scenario client-side hashing would protect against.

Re:Let them paste passwords by consp on Friday May 19, 2017 @04:20AM (#14373757)
Man in the middle attacks fetching for plaintext passwords

-- edit: using a KDF would improve it even more.

Re:Let them paste passwords by anonymouz on Friday May 19, 2017 @04:58AM (#14373902)
If the client only sends the hash to the server, a MitM also only needs to capture the hash.
Re:Let them paste passwords by croon on Friday May 19, 2017 @05:04AM (#14373929)
Sure, but if they've MITM:ed your trusted certs, aren't you already boned in so many ways?