Contents
Is authentication client side safe?
Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected. Do not rely on client side data. Always perform server side authentication.
What is client side authentication?
Client-side authentication is when authentication checks are performed completely at users’ side. The idea is that the authentication procedures, methods, or codes are delivered to the client, where they are executed to determine whether a user has access.
Why do we use client side hashing for passwords?
The client side hashing is for the peace of mind for the user that their literal password is never being received by the server, even if there is the assurance of hashing it in storage anyway.
Where are hashed passwords stored on a server?
Since the (hashed) passwords sent by the clients are stored as-is in the database, such an attacker can impersonate all users by sending the server the hashed passwords from the database as-is.
Can a hash be used as a password?
Replayed messages are not permitted. ie. the hash sent from the client cannot effectively be used as a password by an eavesdropper. Temp-banning and blacklisting IPs is possible for multiple unsuccessful sign in attempts within a short time frame. This may be per user account, or system wide. “Avoid devising homebaked authentication schemes.”
Why do we use slow hashes instead of fast hashes?
Password hashing helps prevent anyone except the user from learning the password. People reuse passwords and they are usually not very strong if memorised. That’s why we bother with slow hashes (Bcrypt, Scrypt, Argon2, etc.) instead of a fast hash: it protects the user’s password better, even though it does not have any benefit for the application.