News for hackers. Stuff that matters.
Re:WeChat permanently closes account after user sets offensi... by mneubrand on Friday June 05, 2020 @01:08PM (#23430839)
You can't enforce complexity rules or check against known leaked passwords or that they don't reuse username as password or anything like that if you hash on the client too
Re:WeChat permanently closes account after user sets offensi... by ALittleLight on Friday June 05, 2020 @01:28PM (#23431182)
You can check complexity or username reuse client side. You could even block the n most common passwords clientside if you wanted to.
Re:WeChat permanently closes account after user sets offensi... by phab on Friday June 05, 2020 @01:34PM (#23431278)
But I could just ignore/comprimise/modify your client and submit whatever I liked to the server.
Re:WeChat permanently closes account after user sets offensi... by smolder on Friday June 05, 2020 @01:44PM (#23431436)
What's the motivation of someone able to do that and interested in doing it?
Re:WeChat permanently closes account after user sets offensi... by SiNiquity on Friday June 05, 2020 @01:50PM (#23431530)
Primarily to get around arbitrary password rules that do not enhance the security of the password but serve to weaken it, e.g. only use special characters from this list: !@#, or sorry your password is TOO LONG (?!)
Re:WeChat permanently closes account after user sets offensi... by labawi on Friday June 05, 2020 @04:28PM (#23433585)
That's true, but only to a point. You can actually server-side check username/password equality, and a not overly long list of other unwanted passwords. You just have to check each one.