Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Subject: Re: Improving password hashing.
Mime-Version: 1.0 (Apple Message framework v1084)
Content-Type: text/plain; charset=us-ascii
From: Noah Slater <nslater@apache.org>
In-Reply-To: 
 <CABvT1DGGr+1VokWh5GPNcVACXAeJJSRQ98h7jU=TzKirjSc4Jw@mail.gmail.com>
Date: Wed, 6 Jul 2011 16:00:24 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <A7CEA3DB-65ED-41FA-B2A5-A6FFEEA73FD2@apache.org>
References: 
 <CABvT1DFkZHWMZ15DCVQiedy9+GdgCtXhMtY-8qfPq35bmeHOsw@mail.gmail.com>
 <CAJNb-9qviqvOFNZju59ixaM+8Qf=7hqUPsFHr7unh+sqi=GZ4g@mail.gmail.com>
 <CABvT1DERcrCFVkzZBSQYFruTnqEEEu0JUU3gQ2pMdPGTYawT8Q@mail.gmail.com>
 <CAL3q7H5FEYJe0gugkvAYQ7GOduYCYqbNWH37jxwTQ-ry=70b3w@mail.gmail.com>
 <CABvT1DHMatLeR95sY019SqXmagokF+wKdVX26ebO4yUHj2PDJw@mail.gmail.com>
 <CAL3q7H6JqzEDknHt3cuDuC0oc_2RPjEx7g=iKBjxWGsBScRo+w@mail.gmail.com>
 <CABvT1DGGr+1VokWh5GPNcVACXAeJJSRQ98h7jU=TzKirjSc4Jw@mail.gmail.com>
To: dev@couchdb.apache.org


On 6 Jul 2011, at 15:43, Robert Newson wrote:

> Essentially, in 1.2, I'm saying that the password setting
> functionality occurs solely on the Erlang side, it can't be done from
> Javascript any more. I'm unsure how controversial that is, but it's my
> experience that it's always the server that gets the plaintext of a
> password and hashes it for storage, it's only here that I've seen it
> done in the client.

There's a reason for this. Unless I'm missing something, if the client =
is allowed to submit the password hash itself, you may as well be using =
plaintext passwords. All an attacker would have to do is gain access to =
the hashes, and use them directly.