StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POGWT/Javascript client side password encryption
text
Body
copied!<p>I'm implementing authorization in my gwt app, and at the moment it's done in the following fashion:</p> <ol> <li>The user signs up by putting his credentials in a form, and I send them in clear text to the server.</li> <li>The server code hashes the received password using BCrypt and puts the hash in a database.</li> <li>When the user logs in, his password is sent in the clear to the server, that checks it against the stored hash.</li> </ol> <p>Now. The thing that's bothering me about this is the fact that I'm sending the password to the server in the clear, I keep thinking that I wouldn't be very pleased if an application I was using did that with my (use-for-everything-kind) password, but encrypting it on the client wouldn't really earn me anything, since the attackers could just use the hashed password as they would the clear one.</p> <p>I have been <a href="http://www.google.be/#hl=nl&source=hp&q=gwt+client+password+encryption&aq=f&aqi=&aql=&oq=&gs_rfai=&fp=989bd28e744ddd6" rel="noreferrer">googling</a> all day for this, and it seems the Internet is quite unanimous when it comes to this - apparently there is nothing to be gained from client side password encryption. <a href="http://raibledesigns.com/rd/entry/password_encryption_with_javascript" rel="noreferrer">This</a>, <a href="http://comments.gmane.org/gmane.org.google.gwt/47164" rel="noreferrer">this</a> and <a href="http://code.google.com/p/gwt-crypto/wiki/ClientSideEncryptionConsiderations" rel="noreferrer">this</a> are just a few examples of the discussions and pages I've come by, but there are many, many more, all saying the same thing.</p> <p>This question, in light of all this, might seem a bit unnecessary, but I am hoping that somewhere, someone, will have another answer for me.</p> <p>What can I do, <strong><em>if ssl isn't an option at this point</em></strong>, to ease my mind about this? Is there anything to be done, or will implementing some sort of client-encrypt-server-decrypt-scheme just be time-consuming feeble dead-horse-kicking?</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload