News for hackers. Stuff that matters.

A comment on Twitter urges users to change passwords after computer 'glitch'. Parent comment

Re:Twitter urges users to change passwords after computer 'g... by tada-ssola on Thursday May 03, 2018 @07:53PM (#16991040)
I think there is value in that. I would still be sure to hash it a second time on the server.

My guess is that this isn't popular because of the added client side complexity.

I'm also curious if anyone has considered or implemented this idea.

[ Parent | on HN ]
Re:Twitter urges users to change passwords after computer 'g... by tada-ssola on Thursday May 03, 2018 @08:02PM (#16991089)
Ah answered elsewhere, if the client sends the hash and you log the hash then you still have a problem. The user should change passwords.

Although I think this still improves the situation if the password is reused. I.E. I can't use the logged hashed password on other sites.

[ Parent | on HN ]