Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The idea is nice but in theory but that would be a _huge_ security risk. You'd be providing anyone you know with your encrypted password, as well as the encryption method.


No, why?

The server will send down a hash function, a salt and its version of a password hash. Use something like bcrypt or PBKF2, reduce their output by folding or by funneling through something like CRC to mitigate the risk of brute-forcing. Alternatively, keep salt/hash on the server side and make the client ajax the current hash from the server.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: