News for hackers. Stuff that matters.

A comment on Password may not contain: select, insert, update, delete, drop. Parent comment

Re:Password may not contain: select, insert, update, delete,... by TacticalCoder on Sunday January 21, 2024 @09:14AM (#39078578)
Is it a slow sunday for me or... If you hash the password on the client and send the hash then hash is the password. And if you then have, for example, a DB leak with username and hashes, you don't need the password anyway because you can just send the hash and log in? (but then it's sunday and I need more coffee so I may be wrong)
[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by gvx on Sunday January 21, 2024 @09:34AM (#39078766)
That is correct.

The client sends the encrypted (via HTTPS) but not hashed password to the server, both for changing your password and checking your password. So the server receives the password in plaintext but shouldn't store it.

Whatever the client sends to the server, an attacker can send too.

[ Parent | on HN ]
Re:Password may not contain: select, insert, update, delete,... by andy81 on Sunday January 21, 2024 @04:35PM (#39083308)
You're not the first to come up with that exploit-

https://en.wikipedia.org/wiki/Pass_the_hash

[ Parent | on HN ]