News for hackers. Stuff that matters.

A comment on Let them paste passwords. Parent comment

Re:Let them paste passwords by consp on Friday May 19, 2017 @04:20AM (#14373757)
Man in the middle attacks fetching for plaintext passwords

-- edit: using a KDF would improve it even more.

[ Parent | on HN ]
Re:Let them paste passwords by anonymouz on Friday May 19, 2017 @04:58AM (#14373902)
If the client only sends the hash to the server, a MitM also only needs to capture the hash.
[ Parent | on HN ]
Re:Let them paste passwords by croon on Friday May 19, 2017 @05:04AM (#14373929)
Sure, but if they've MITM:ed your trusted certs, aren't you already boned in so many ways?
[ Parent | on HN ]