News for hackers. Stuff that matters.

A comment on Personal File Backup Server. Parent comment

Re:Personal File Backup Server by JshWright on Thursday February 28, 2013 @12:55AM (#5297292)
>- Naive authentication. - Unsalted, fast hash sent in the URL. - Password stored in clear text server side.

I don't understand the point of hashing the password in the client anyway... The hash is as good as the password to an attacker.

[ Parent | on HN ]
Re:Personal File Backup Server by aj-code on Thursday February 28, 2013 @01:05AM (#5297324)
Sure is!

It would be possible to use a challenge response authentication scheme (http://en.wikipedia.org/wiki/Challenge%E2%80%93response_auth...) but just doing things over HTTPS is generally fine.

[ Parent | on HN ]