News for hackers. Stuff that matters.

A comment on WeChat permanently closes account after user sets offensive password. Parent comment

Re:WeChat permanently closes account after user sets offensi... by Sir_Substance on Friday June 05, 2020 @06:18PM (#23434680)
>and it does further protect the users password from being harvested from passive MITM'd SSL like it is on some corporate networks.

It might protect the password if the user is reusing it elsewhere, but it doesn't protect the account the password is securing during the intercepted transmission.

The MITM attacker can just replay the hash.

[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by nucleardog on Friday June 05, 2020 @11:22PM (#23436544)
No reason the server can’t provide a nonce for the login to salt the hash.
[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by Sir_Substance on Saturday June 06, 2020 @07:10PM (#23443164)
Now the server has to store the password in plain text so it can rehash with the new nonce every time.
[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by withinboredom on Saturday June 06, 2020 @06:22AM (#23438142)
And how would the server know the desalted hash?
[ Parent | on HN ]