Contents
Should I hash server side or client side?
But simply hashing the password on the client side is only just better than submitting it as plain text to the server. Someone, who can listen for your plain text passwords is certainly also able to listen for hashed passwords, and use these captured hashes him/herself to authenticate against your server.
Do you need to hash passwords client side?
Hashing passwords makes it possible to use them for authentication, while making it hard to reconstruct the original password. Hashing passwords on the client may be beneficial: even though it does not protect against attackers, it does protect against accidental mistakes.
Is there a hash client side password hashing Stack Exchange?
(Personally, I keep a file of passwords, and all my passwords are generated randomly.) A Google employee is working on something similar called TLS-OBC. This RFC draft allows the client to hash the password and bind it to a TLS session.
Which is a good case for client side hashing?
A good case for client-side hashing is the way some “password safes” work: they compute a site-specific password by hashing the user’s “master password” together with the site name. This gives most of the usability of always using the same password everywhere, while not actually giving your master password to dozens of distinct site.
What happens if everybody hashes the same password?
Which is evidenced by the fact that if everybody did the same client side hash thing, then the attacker would be able to reuse those hashes. Thus, if the user has different passwords for different services, you approach earns nothing. Addendum: What if you wanted to defend the user from the administrators?
Is it better to hash or salt passwords?
It is good practice to hash on the client side, then salt the password and hash again on the server side. This is an extra layer of protection against man in the middle attacks. SSL is the first layer however Snowden’s revelations made it clear that SSL can be compromised by organisations such as the NSA with relative ease.