undefined | Better HN

0 pointsjarkhen5y ago0 comments

Ah, right, I misread the original description of what they were doing.

As is, then, it really is just making the hashed password the new password. If I can get the hashed password out of the DB, I can load the login page and simply skip the initial hashing step that's done on the frontend. I now have access to the account without ever knowing the original password.

0 comments

SAI_Peregrinus5y ago

Except that it's easy (indeed, required for security) to change the nonce for each login request, so you can't just replay the hash.

jarkhenOP5y ago

That protects against an attacker reading network traffic. It does not protect against an attacker that has the hashed password from the DB.

The only thing you need in order to authenticate at any given time is the hash of (hashed password + nonce). The latter you get for free, at any time, from the server, so you only need to know the hashed password -- not the password itself. Since the hashed password is directly stored in the DB, if you get your hands on that you can authenticate.

SAI_Peregrinus5y ago

Right. My mistake. I should have thought it through more thoroughly before posting. Hopefully my comment doesn't mislead anyone, I'll try to do better in the future.

j / k navigate · click thread line to collapse

0 pointsjarkhen5y ago0 comments

Ah, right, I misread the original description of what they were doing.

0 comments

SAI_Peregrinus5y ago

Except that it's easy (indeed, required for security) to change the nonce for each login request, so you can't just replay the hash.

jarkhenOP5y ago

That protects against an attacker reading network traffic. It does not protect against an attacker that has the hashed password from the DB.

SAI_Peregrinus5y ago

Right. My mistake. I should have thought it through more thoroughly before posting. Hopefully my comment doesn't mislead anyone, I'll try to do better in the future.

j / k navigate · click thread line to collapse