this post was submitted on 18 Jul 2023
10 points (81.2% liked)
Discussions related to Infosec.pub
1229 readers
1 users here now
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The server needs to receive your password to verify it and log you it. That's how it always is. As long as you are connecting via HTTPS, this is not a problem.
Why not hash it client side? Edit: Isn't SSL vulnerable to MITM attacks? (I am a noob in this field)
Most of the comments are misconceptions. SSL/TLS is supposed to create a tunnel on top of TCP. If implented correctly, it is supposed to connect, establish a session key, and anything going back and forth from server to client will be using the tunnel using a symmetric encryption. On client side usually your password will be sent plaintext before the server hashes it and checks against a db of hashes. Client side should not hash the password which I am fairly sure would allow pass-the-hash, but don't quote me on that. Also, there is possiblity of MITM, but it requires specific conditions and isn't like with how sslstrip or whatever was a while ago.
I'm tired so I might be wrong about some of this stuff, but The cryptography SO has a lot of questions on how SSL/TLS works and I suggest googling how TLS works.
I will check it out. Thanks!