News for hackers. Stuff that matters.

A comment on Twitter urges users to change passwords after computer 'glitch'. Parent comment

Re:Twitter urges users to change passwords after computer 'g... by honoredb on Thursday May 03, 2018 @06:29PM (#16990608)
No, there fundamentally isn't, because you can't trust the client to actually be hashing a password. If all the server sees is a hash, the hash effectively is the password. If it's stolen, a hacker can alter their client to send the stolen hash to the server.
[ Parent | on HN ]
Re:Twitter urges users to change passwords after computer 'g... by iGoog on Thursday May 03, 2018 @07:00PM (#16990799)
If a hash is salted with a domain it won't be use-able on other websites. You should additionally hash the hash on the server, and if you store the client hashes, you can update the salts on next-sign in. A better question is why clients should be sending unhashed passwords to servers in the first place. https://medium.com/the-coming-golden-age/internet-www-securi...
[ Parent | on HN ]
Re:Twitter urges users to change passwords after computer 'g... by Tarean on Sunday May 06, 2018 @10:03AM (#17006438)
This discussion is only relevant with an attacker that can break tls. A hash that such an attacker couldn't reverse might be slow on old phones so there is a tradeoff.

Also, hashed passwords shouldn't be logged either.

[ Parent | on HN ]