2
Passwords sent as plaintext? (infosec.pub)
submitted 3 years ago by to c/infosecpub@infosec.pub
14 comments fedilink hide all child comments
 

I tried logging in on browser and I had inspected the request. My password was sent in plaintext. Is this a infosec.pub issue or a Lemmy one?

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 3 years ago* (2 children)

this measure of security would have been completely void...

Why not hash it server side too? I'm asking because I'm curious

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 3 years ago (2 children)

    That doesn't make any sense. If you hash it once on client and once on server, that means that your password, as far as the server knows, is the client-hashed password. Nothing has changed in terms of security. In fact, you could implement this yourself by hashing your password when creating it and when supplying it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 3 years ago

    That's actually a good thought though. It would prevent (clear text) password leaks from shitty / malicious websites. Having a standard for browsers to salt and hash password would have prevented a lot password leaks. On the other hand it could never be updated and we would most likely be stuck on md4 or something similarly broken.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 3 years ago (1 child)

    Because it provides no advantage. TLS is used to secure any data sent to a server. If you don't trust the server with your password, then you should use a unique password for this website. In fact, you should always use a unique password.

    https://www.cloudflare.com/en-ca/learning/ssl/transport-layer-security-tls/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •