Hacker News new | ask | show | jobs
by angelsl 2947 days ago
This just makes the password the hash of the user's passphrase.
1 comments

> This just makes the password the hash of the user's passphrase.

There are some other advantages that others have already mentioned, but even if that was all it did it would still be useful in inhibiting an attacker from learning the actual passphrase which many users are likely to have reused on other services.

It would also be useful in finding hash collisions which would give an attacker access to a user's account without needing the actual password, which is made easier with the ability to study the client-side code doing the hashing, and taking note of the algorithm and methods used.

Sending a password in plaintext over HTTPS is more secure than hashing it in javascript first and sending the hash.

> It would also be useful in finding hash collisions which would give an attacker access to a user's account without needing the actual password

If it's practical to find a hash collision, your hash algorithm is broken.

> which is made easier with the ability to study the client-side code doing the hashing, and taking note of the algorithm and methods used.

The security of a system should not depend at all on that information being secret.