Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by estel on Tuesday September 25, 2012 @03:54PM (#4572318)

It's perfectly possible to use md5 to hash a password in Javascript before transmitting it by HTTP. There isn't a huge security benefit to doing so, however.

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by omra on Tuesday September 25, 2012 @04:42PM (#4572551)

Only doing that won't help. You might as well be transmitting the password, since someone can just copy the hash and then it would be equivalent to having the password. (Also known as a Pass the Hash attack, http://en.wikipedia.org/wiki/Pass_the_hash).

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by wisty on Tuesday September 25, 2012 @05:06PM (#4572661)

Each website could have a salt. The issue is, if it's not a secure connection, it's vulnerable to hijacks.

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by Tloewald on Tuesday September 25, 2012 @08:46PM (#4573623)

You can send a salted md5 password, which is how I implemented it years ago. The salt is supplied by the server and attached to the session.

[ Parent | on HN ]