Re:Twitter urges users to change passwords after computer 'g...
by amelius on Friday May 04, 2018 @08:39AM
(#16994066)
You prevent a lot of these problems by hashing passwords as soon as possible (i.e., on the client).
[ Parent
| on HN ]
Re:Twitter urges users to change passwords after computer 'g...
by amhokies on Friday May 04, 2018 @09:02AM
(#16994233)
Wouldn't that make it easier for someone that has access to hashed passwords in the case of a database leak? They would just have to submit the username and the hashed password (which they now have).
Re:Twitter urges users to change passwords after computer 'g...
by etruong42 on Sunday May 06, 2018 @03:28PM
(#17007964)
You're right, but the attacker won't get the user's original password that they probably reuse elsewhere.
If it's just your authentication system hashes that are compromised, the damage can be contained.
Re:Twitter urges users to change passwords after computer 'g...
by jageen on Monday May 07, 2018 @10:08PM
(#17018283)
In this case client side will have our algorithm (i.e in JavaScript) + private key which we will use to hash the password. If this is the case I could not see any different between giving hacker password or hash-password with algorithm and key.