6 ms·
If you are doing this, then the hash IS the password. That means if someone steals your database, the could log in as all of your users just by tweaking the cli
by espo 15y ago
If you are doing this, then the hash IS the password. That means if someone steals your database, the could log in as all of your users just by tweaking the client-side JavaScript with grease-monkey or similar.
- WA 15y agoRight. I just realize my approach is flawed ;)
- jules 15y agoWhat if you use a cheaper hash function (e.g. bcrypt with a lower work factor) on the server? The bcrypt hash is the password, but a very long one compared to the password that the user entered, so presumably it is very expensive to brute force even with a relatively cheap hash function.