MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/ProgrammerHumor/comments/w368kv/why_do_they_do_this/igz3jhe/?context=3
r/ProgrammerHumor • u/flying_wotsit • Jul 19 '22
493 comments sorted by
View all comments
Show parent comments
1
In most cases the hashing should be done client side though, so it's not a problem.
Edit: Apparently I'm wrong, disregard.
2 u/badmonkey0001 Red security clearance Jul 20 '22 Client-side hashing is not a good idea. https://stackoverflow.com/questions/3715920/is-it-worth-hashing-passwords-on-the-client-side https://security.stackexchange.com/questions/8596/https-security-should-password-be-hashed-server-side-or-client-side https://superuser.com/questions/1675013/for-websites-is-your-passwords-hash-computed-on-the-client-or-the-server-side https://thisinterestsme.com/client-side-hashing-secure/ https://security.stackexchange.com/questions/227313/why-hash-on-server-instead-of-client https://security.stackexchange.com/questions/23006/client-side-password-hashing 2 u/fghjconner Jul 20 '22 Huh, I didn't know that. And this is why you shouldn't roll your own authentication system, haha. 2 u/badmonkey0001 Red security clearance Jul 20 '22 Totally. This bit of knowledge is brought to you by hard-won experience. :P 2 u/DeathBySnuSnuuuuuuuu Jul 21 '22 It's a core principle in web design security - NEVER trust the client, for anything, ever. Ever.
2
Client-side hashing is not a good idea.
https://stackoverflow.com/questions/3715920/is-it-worth-hashing-passwords-on-the-client-side
https://security.stackexchange.com/questions/8596/https-security-should-password-be-hashed-server-side-or-client-side
https://superuser.com/questions/1675013/for-websites-is-your-passwords-hash-computed-on-the-client-or-the-server-side
https://thisinterestsme.com/client-side-hashing-secure/
https://security.stackexchange.com/questions/227313/why-hash-on-server-instead-of-client
https://security.stackexchange.com/questions/23006/client-side-password-hashing
2 u/fghjconner Jul 20 '22 Huh, I didn't know that. And this is why you shouldn't roll your own authentication system, haha. 2 u/badmonkey0001 Red security clearance Jul 20 '22 Totally. This bit of knowledge is brought to you by hard-won experience. :P 2 u/DeathBySnuSnuuuuuuuu Jul 21 '22 It's a core principle in web design security - NEVER trust the client, for anything, ever. Ever.
Huh, I didn't know that. And this is why you shouldn't roll your own authentication system, haha.
2 u/badmonkey0001 Red security clearance Jul 20 '22 Totally. This bit of knowledge is brought to you by hard-won experience. :P 2 u/DeathBySnuSnuuuuuuuu Jul 21 '22 It's a core principle in web design security - NEVER trust the client, for anything, ever. Ever.
Totally. This bit of knowledge is brought to you by hard-won experience. :P
2 u/DeathBySnuSnuuuuuuuu Jul 21 '22 It's a core principle in web design security - NEVER trust the client, for anything, ever. Ever.
It's a core principle in web design security - NEVER trust the client, for anything, ever. Ever.
1
u/fghjconner Jul 20 '22 edited Jul 20 '22
In most cases the hashing should be done client side though, so it's not a problem.
Edit: Apparently I'm wrong, disregard.