News for hackers. Stuff that matters.
Re:WeChat permanently closes account after user sets offensi... by l0b0 on Friday June 05, 2020 @04:17PM (#23433451)
The first sentence is true (and I can't believe how far down this thread it first appeared), but nobody was advocating abolishing server side hashing as well.

Basically, hashing on the client does absolutely nothing for the security of the transfer or storage of the password. Whatever the client passes to the server, whether it's hashed or not, is effectively their password, and intercepting that (again, whether hashed or not) would give an attacker the actual credentials of the user.

There are no comments on this comment yet.