Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

7
  • 3
    This is the best answer so far. Commented May 18, 2011 at 1:17
  • 3
    I think hashing a password client-side does add security. If I'm listening in, I can only see your hash, not your password. If the server sends a challenge (as it should) the hash is not even reusable. Commented Jun 14, 2012 at 9:13
  • 2
    I think x4u's approach may very well be appropriate for some applications where security requirements are somewhere between transmitting passwords on the wire and using certificates. I think some of the nay sayers are overlooking that the hashing of the password before it goes on the wire is done in addition to the standard server side credential handling. So the question is this: Does x4u's proposal improve security in the transmission-of-password-on-the-wire-scenario or not. I say it does. The key to realizing this lies in the usage of per-password salts. Commented Jul 23, 2013 at 9:19
  • 6
    The correct way to prevent MITM attacks is end-to-end encryption. TLS (https) exists: use it. Don't invent your own crypto schemes. Commented Jul 24, 2013 at 17:48
  • 2
    Because it's a lot of extra work for zero gain. This is incorrect. Hashing password on client side is extremely useful for offline web apps since users don't need to wait for server response to be authenticated. In addition, this server relief approach can help reduce DoS opportunities. Commented Apr 26, 2015 at 7:55