News for hackers. Stuff that matters.

A comment on WeChat permanently closes account after user sets offensive password. Parent comment

Re:WeChat permanently closes account after user sets offensi... by lordlimecat on Friday June 05, 2020 @01:15PM (#23430944)
Technically, you should be doing hash(hash(password) + nonce). The server should not know the password, only the password's hash.
[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by fhars on Friday June 05, 2020 @01:33PM (#23431256)
That just turns hash(password) into the effective plain text password, which the server must know in this scheme.
[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by lordlimecat on Friday June 05, 2020 @03:28PM (#23432790)
Correct. The server should be storing the password hashed as Hash(Password+Salt) to make it impractical for an attacker to recover the user's password.

Recovering whatever the server has stored is typically going to be sufficient to authenticate the user, but storing it as a hash mitigates some threats.

[ Parent | on HN ]