I’ve developed my application to use salted SHA-512 password hashes.
If a hacker were to obtain the hash, what can I do to protect against the hacker using Greasemonkey to alter the login page so that the password is not hashed? The attack vector I foresee would enable them to type the hash they’ve acquired into the password input and then the Greasemonkey-altered page sends that info as is (w/o hashing the entered password which is the actual hash).
That is just one example of how an acquired hash could be used. There are other ways the site’s code could be altered with Greasemonkey to achieve the same result.
I can’t think of any ways to prevent / protect against this type of attack.
Has anyone here come up with something?
Hash your passwords on the server. Use SSL to protect over the wire.