Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

16
  • 19
    a hashed password sent in the clear is no better than a password sent in the clear if the server is just comparing hashes, man in the middle attacks love this kind of "security" Commented May 17, 2011 at 21:14
  • 3
    The best solution is (imo) a client side password manager. That way, you can generate a random string of characters as your password and you're not relying on the server to 'protect' you. Commented May 17, 2011 at 22:20
  • 3
    @Jarrod - it sounds to me, though, like different web sites using different client-side hashing algorithms would prevent the attack described by that comic. One widely re-used password becomes many different passwords through those differing hash algorithms. That client-side hash calculation doesn't prevent other kinds of security being applied - such as sending the hash through a secure connection. Commented May 17, 2011 at 22:26
  • 2
    @Steve314 my point is anything on the client is compromised by default. You can hash and hash and hash, if it is being done on the client and being passed back and forth to the server in the clear it is just mathematical masturbation at that point. I had to fix a system I inherited, that was designed the exact way you and the OP describe, it was constantly being hacked by teenagers with Wireshark. We only locked it down when we put in REAL encryption and encrypted and signed all the payloads to and from the server, the account manipulation stopped and never happened again after that. Commented May 18, 2011 at 16:27
  • 5
    It sounds like your plan for protecting yourself against rogue sites is to ask the rogue sites to set up better security. ? Commented Mar 9, 2012 at 16:15