News for hackers. Stuff that matters.
Re:Twitter urges users to change passwords after computer 'g... by amelius on Friday May 04, 2018 @08:39AM (#16994066)
You prevent a lot of these problems by hashing passwords as soon as possible (i.e., on the client).
Re:Twitter urges users to change passwords after computer 'g... by amhokies on Friday May 04, 2018 @09:02AM (#16994233)
Wouldn't that make it easier for someone that has access to hashed passwords in the case of a database leak? They would just have to submit the username and the hashed password (which they now have).
Re:Twitter urges users to change passwords after computer 'g... by etruong42 on Sunday May 06, 2018 @03:28PM (#17007964)
You're right, but the attacker won't get the user's original password that they probably reuse elsewhere.

If it's just your authentication system hashes that are compromised, the damage can be contained.

Re:Twitter urges users to change passwords after computer 'g... by jageen on Monday May 07, 2018 @10:08PM (#17018283)
In this case client side will have our algorithm (i.e in JavaScript) + private key which we will use to hash the password. If this is the case I could not see any different between giving hacker password or hash-password with algorithm and key.
Re:Twitter urges users to change passwords after computer 'g... by larkeith on Friday May 04, 2018 @09:26AM (#16994411)
While there is merit to clientside hashing, you should always hash serverside as well, lest a leak prove catastrophic.