All geek questions in one place

Hash passwords before passing? (Web)

I read this about password security and mentioned that there are sites that have a "hash password before transferring"?

Now, considering that this is not using an SSL connection (HTTPS), a. it is really safe and b. if so, how do you do it in a safe estate?

Edit 1: (some thoughts are based on first answers)

with. If you make a hash password before passing, how do you use it if you only store a salted hash of the password in your user credentials?

e. Just check if you are using a secure HTTPS connection, is any of this necessary?

+3
source share
3 answers

, (, , ).

, .

, "--".

+5

, , . - , , . , , .

, - . , () , .

JavaScript SHA-1, . MD5, .

+1

"--", .

:

  • H D S D
  • S R
  • K S R
  • S D S R
  • The client computes H D by stitching the user password using S D
  • The client computes K by hashing H D with S P
  • The client encrypts all communication with the server using K

This scheme creates a random session key K based on the user's password.
A person in the middle could not get K without knowing the user's password (or H D , which should be kept secret), and therefore can not impersonate a server.

+1
source

Source: https://habr.com/ru/post/1749277/

More articles:


All Articles