Home/ Questions/Q 835307
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T04:48:25+00:00

I was reading this Ars article on password security and it mentioned there are

  • 0

I was reading this Ars article on password security and it mentioned there are sites that “hash the password before transmitting”?

Now, assuming this isn’t using an SSL connection (HTTPS), a. is this actually secure and b. if it is how would you do this in a secure manor?

Edit 1: (some thoughts based on first few answers)

c. If you do hash the password before transmission, how do you use that if you only store a salted hash version of the password in your user credentials databas?

d. Just to check, if you are using a HTTPS secured connection, is any of this necessary?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is only secure if the server sends a non-reusable salt (and, of course, if you use a secure hash).

    Otherwise, the attacker can simply sniff the users hash, then replay the hash to log in as the user.

    Note that the login is vulnerable to a man-in-the middle attack.

    • 0