search

mxstbr / login-flow

:key: A login/register flow built with React&Redux
https://loginflow.mxstbr.com
MIT License
1.6k stars 215 forks source link

Encrypt password on the frontend before sending the request #2

Closed mxstbr closed 8 years ago

mxstbr commented 8 years ago

Security reasons

geakstr commented 8 years ago

Encryption on the client is not secure, isn't it? I think server must be available only through SSL and that's enough.

mxstbr commented 8 years ago

The best way is to encrypt on both the client and the server, so the network and server have no idea of the plaintext password/usernames. Avoids MITM in the local WiFi etc.

geakstr commented 8 years ago

I'm not an expert in security, but what about next example?

  1. Client encrypt password and sent it to server over SSL
  2. MITM in the local WiFi intercepts traffic and get encrypted password
  3. Hacker send encrypted password to server and server accept this

One profit is hacker not to know about original password, yes?

mxstbr commented 8 years ago

Yes exactly, while the hacker can still replay the request, he doesn't have the plaintext password. This means we potentially save the user, who is highly likely using the same password across a number of services, from complete ownage.

geakstr commented 8 years ago

Thank you for explanation. What secure methods to one-way encryption on client-side?

mxstbr commented 8 years ago

bcrypt all the way. (see here or google around a bit as to why)

geakstr commented 8 years ago

Ok 👍

mxstbr commented 8 years ago

By the way, I'd love a PR for this.

geakstr commented 8 years ago

Yeah, I worked on this today for my app, and do this for your project. Check this https://github.com/mxstbr/login-flow/pull/7

marcospgp commented 4 years ago

@mxstbr Doesn't https protect against a man in the middle attack? (Such as someone in the local wifi network like you mentioned)

TheCeloReis commented 2 years ago

@mxstbr Doesn't https protect against a man in the middle attack? (Such as someone in the local wifi network like you mentioned)

This is true, this aproach currently is over engineeringwith client security

hagridleitc commented 2 months ago

Jun 2024, I received this question when I joined the interview. I think this approach is over-engineering also. Instead, you can consider logging in with SSO via Google, Github,...