Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Really your back end should just treat password's hashed just like any password.

Ideally, if TLS was being MITMed somehow such as a dodgy root cert. It would shield the users plaintext password so it could not be used to login into other services. The problem is as soon there is TLS issue an attacker can modify the Js to just send the password in the clear. It really would require code that can't be modified by attacker. This means that there would have to be some sort of browser support. Otherwise it does nothing against the attack it would protect against.

The main benefit is offloading some computation workload on the clients machine. This could allow you to increase the work load required to brute force the password hashes assuming your database leaks. (aka increase iterations or memory requirements)

You last argument is security through obscurity if exposing how you hash makes it easier to brute force the passwords your password hashing sucks.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: