News for hackers. Stuff that matters.

A comment on Gmail password first character is case insensitive on mobile device. Parent comment

Re:Gmail password first character is case insensitive on mob... by nitrogen on Saturday October 09, 2021 @01:42PM (#28811753)
There are formalized approaches to keeping the server from knowing the password at any time: https://en.m.wikipedia.org/wiki/Password-authenticated_key_a...

SRP is one such system: https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...

[ Parent | on HN ]
Re:Gmail password first character is case insensitive on mob... by staticassertion on Saturday October 09, 2021 @05:14PM (#28813366)
The various ZKP approaches are considerably more complex to implement properly vs the trivial approach of a client side hash. There are obvious tradeoffs, of course, but I wouldn't fault someone for an additional hash step on the client.
[ Parent | on HN ]