Twitter urges users to change passwords after computer 'glitch'

Re:Twitter urges users to change passwords after computer 'g... by cerebellum42 on Thursday May 03, 2018 @08:30PM (#16991230)

Ultimately, what the client sends to the server to get a successful authentication _is_ effectively the password (whether that's reflected in the UI or not). So if you hash the password on the client side but not on the server, it's almost as bad as saving clear text passwords on the server.

You could hash it twice (once on the server once on the client) I suppose, but I'm not entirely sure what the benefit of that would be.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by pbhjpbhj on Thursday May 03, 2018 @08:47PM (#16991321)

A benefit would be that under the sort of circumstance in the OP, assuming sites salted the input passwords, the hashes would need reversing in order to acquire the password and so reuse issues could be obviated. But I don't think that's really worth it when password managers are around.

I'm imagining we have a system where a client signs, and timestamps, a hash that's sent meaning old hashes wouldn't be accepted and reducing hash "replay" possibilities ... but now I'm amateurishly trying to design a crypto scheme ... never a good idea.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by deepbreath on Thursday May 03, 2018 @09:10PM (#16991437)

> meaning old hashes wouldn't be accepted and reducing hash "replay" possibilities

How would the server even verify the hash, then?

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by pbhjpbhj on Friday May 04, 2018 @08:32AM (#16994028)

Verify the signature, check the time, use the hash as if it were the password to re-hash and compare with DB?

[ Parent | on HN ]