Comment by mlfreeman
5 days ago
> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.
Don't assume everyone coding a login page is as competent as you though...sadly.
5 days ago
> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.
Don't assume everyone coding a login page is as competent as you though...sadly.
The mechanism proposed by the GP is not competence. It's a well-known vulnerability called "pass the hash".
But the sites where I actually care if my account gets compromised - Steam, FastMail, DigitalOcean etc. - are very unlikely to screw up password storage.
I'm never going to bother with paranoid security inconveniences for the crappy website my local pizza place uses.