Contents
Should I hash the password before sending it to the server side?
It should be irreversibly hashed before leaving the client as there is no need for the server to know the actual password. Hashing then transmitting solves security issues for lazy users that use the same password in multiple locations (I know I do).
What is the correct way to transmit a password from a client to a server?
The only safe method for a website to transfer a password to the server is using HTTPS/SSL. If the connection itself is not encrypted, an ManInTheMiddle can modify or strip away any JavaScript sent to the client. So you cannot rely on client side hashing.
Which is a good case for client side hashing?
A good case for client-side hashing is the way some “password safes” work: they compute a site-specific password by hashing the user’s “master password” together with the site name. This gives most of the usability of always using the same password everywhere, while not actually giving your master password to dozens of distinct site.
Is it worth it to hash client side passwords?
The PBKDF2 in the client will prevent dictionary attacks and the single hash operation on the server side will prevent using the hashed passwords from a stolen database as is. There are few time when client-side hashing is worthwhile.
Why is multi factor authentication better than Password Hashing?
And for people who want more security than password, multi-factor authentication is a better solution. So the second short answer is: because multi-factor authentication provides more security than client-side password hashing. To understand this problem, first you have to understand why we hash passwords.
Why do we use slow hashes instead of fast hashes?
Password hashing helps prevent anyone except the user from learning the password. People reuse passwords and they are usually not very strong if memorised. That’s why we bother with slow hashes (Bcrypt, Scrypt, Argon2, etc.) instead of a fast hash: it protects the user’s password better, even though it does not have any benefit for the application.