WeChat permanently closes account after user sets offensive password

Re:WeChat permanently closes account after user sets offensi... by evanreichard on Friday June 05, 2020 @03:59PM (#23433228)

I think (s)he is saying to hash client side, salt, then hash again server side. So if the database gets compromised, the attacker still has to apply the salt to brute force the hash.

I can't see a reason why this hurts, but it's probably not worth it. The only benefit I can see it having is if the user reuses their passwords on other sites, as now a potential malicious MITM would have to brute force the client side hashed password in order to reuse it on other sites. They would still be able to use that client side hashed PW to authenticate to the service in question, though.

[ Parent | on HN ]

Re:WeChat permanently closes account after user sets offensi... by 0x0 on Friday June 05, 2020 @04:02PM (#23433275)

All the other websites where the users registered using the same email will only hash ONCE though!

[ Parent | on HN ]

Re:WeChat permanently closes account after user sets offensi... by evanreichard on Friday June 05, 2020 @04:24PM (#23433542)

Yeah, thats exactly my point. So the MITM who got the PW after client side hash, but before server side salt and hash would have to brute force that hash in order to use it on those other sites. That's the only benefit I see, and a very specific set of circumstances.

[ Parent | on HN ]

Re:WeChat permanently closes account after user sets offensi... by gpm on Saturday June 06, 2020 @07:39AM (#23438474)

Is it incredibly specific? I feel like that happens time and time again when companies accidently "mitm" themselves with logs or whatever.

[ Parent | on HN ]