News for hackers. Stuff that matters.

A comment on WeChat permanently closes account after user sets offensive password. Parent comment

Re:WeChat permanently closes account after user sets offensi... by tzs on Friday June 05, 2020 @12:52PM (#23430625)
It's only pointless to hash client side if the server does not also hash.

Hashing on the client what the user actually types and sending that hash to the server which then treats that hash as the password can help in the case of users that construct similar passwords for different sites.

A user who uses passwords of the form "<site>.19%Gkm19^GB", for example, would normal be sending "gmail.19%Gkm19^GB" gmail, "twitter.19%Gkm19^GB" to Twitter, and so on. If anyone one of those gets compromised there is a good chance they all will be.

If the sites had a first step of client siding hashing then the password that gmail sees is "0d156132c43e7110b5d678eafd7117b5a4649fbf" and the one twitter sees is "cfd9d7f62b92eb025a242bc860d41aae60ebeacf". One of those getting compromised on the wire or at the server doesn't put the other at risk.

[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by Retric on Friday June 05, 2020 @09:16PM (#23435925)
If you accept that someone could compromise the web server but be unable to modify the website sent then sure. More generally if you don’t trust the other end you should not be using passwords.
[ Parent | on HN ]