News for hackers. Stuff that matters.
Re:Robinhood Stored Passwords in Plaintext by Someone1234 on Wednesday July 24, 2019 @08:37PM (#20521585)
It is possible. But much easier to get wrong than to get right.

Specifically if you hash the password client side then the hash fundamentally becomes the password, and having that sit plaintext in logs is identical to the pre-hash password since both can re-played to authenticate.

I believe this is still a respected/secure version of what you describe:

https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

Re:Robinhood Stored Passwords in Plaintext by gpm on Wednesday July 24, 2019 @09:49PM (#20521930)
No, having a client side hashed password sit in your logs is way better because it only introduces risk for your own service, instead of risk for every user who reuses their password on multiple services. It changes a compromise log from a widespread identify theft risk to a contained privilege escalation risk.

(Provided either you, or all the other services using this scheme, are sensible enough to salt with a string unique to their website such as a domain name)

Re:Robinhood Stored Passwords in Plaintext by Hello71 on Wednesday July 24, 2019 @09:49PM (#20521934)
just "hashing the password" is not a "challenge-response" protocol.
Re:Robinhood Stored Passwords in Plaintext by cyc115 on Thursday July 25, 2019 @01:24AM (#20522782)
Thank you