I noticed that most sites send the passwords as plain text over HTTPS to the server. Is there any advantage if instead of that I sent the hash of the password to the server? Would it be more secure?
-
7@Jader Dias: I know you didn't ask this, but it wouldn't make any more secure if you hash it, THEN send it over https. In fact, it might make it less secure, since you exposes your salt. Also, (talking out my back-side here), the mixing of algorithms might cause more hash collisions, and make it more hackable.– Merlyn Morgan-GrahamAug 2, 2010 at 20:26
-
@Merlyn "hash collisions" good point!– Jader DiasAug 3, 2010 at 11:46
-
1Mixing algorithms does not increase collision probability at all. That's the whole point of a hash function. Given any input entropy, return output that has an equal probability of being anywhere in the possible output space.– J.JMar 8, 2016 at 17:39
-
3@J.J "Mixing algorithms does not increase collision probability at all." I would really like to see a proof of that statement. Let me stop you: this is false, in general it does increase collisions. I can easily construct a hashing function such that h(x) is not constant 0 but h(h(x))=0 for all x. So you would have to refer to exact set of hashing algorithms and how you mix them. Then you would need to prove your statement. AFAIK even for multiple SHA (with salt) this is an open problem. And basically we believe this is true. Cryptography is hard.– freakishJul 11, 2019 at 11:56
13 Answers
This is an old question, but I felt the need to provide my opinion on this important matter. There is so much misinformation here
The OP never mentioned sending the password in clear over HTTP - only HTTPS, yet many seem to be responding to the question of sending a password over HTTP for some reason. That said:
I believe passwords should never be retained (let alone transmitted) in plain text. That means not kept on disk, or even in memory.
People responding here seem to think HTTPS is a silver bullet, which it is not. It certainly helps greatly however, and should be used in any authenticated session.
There is really no need to know what an original password is. All that is required is a reliable way to generate (and reliably re-generate) an authentication "key" based on the original text chosen by the user. In an ideal world this text should immediately generate a "key" by salting then irreversibly hashing it using an intentionally slow hash-algorithm (like bcrypt
, to prevent Brute-force). Said salt should be unique to the user credential being generated.
This "key" will be what your systems use as a password. This way if your systems ever get compromised in the future, these credentials will only ever be useful against your own organisation, and nowhere else where the user has been lazy and used the same password.
So we have a key. Now we need to clean up any trace of the password on the clients device.
Next we need to get that key to your systems. You should never transmit a key or password "in the clear". Not even over HTTPS. HTTPS is not impenetrable. In fact, many organisations can become a trusted MITM - not from an attack perspective, but to perform inspections on the traffic to implement their own security policies. This weakens HTTPS, and it is not the only way it happens (such as redirects to HTTP MITM attacks for example). Never assume it is secure.
To get around this, we encrypt the key with a once off nonce.
This nonce is unique for every submission of a key to your systems - even for the same credential during the same session if you need to send it multiple times. You can reverse said nonce (decrypt), once it arrives in your own systems to recover the authentication key, and authenticate the request.
At this point I would irreversibly hash it one last time before it is permanently stored in your own systems. That way you can share the credential's salt with partner organisations for the purposes of SSO and the like, whilst being able to prove your own organisation cannot impersonate the user. The best part of this approach is you are never sharing anything generated by the user without their authorisation.
Do more research, as there is more to it than even I have divulged, but if you want to provide true security to your users, I think this method is currently the most complete response here.
TL;DR:
Use HTTPS. Securely hash passwords, irreversibly, with a unique salt per password. Do this on the client - do not transmit their actual password. Transmitting the users original password to your servers is never "OK" or "Fine". Clean up any trace of the original password. Use a nonce regardless of HTTP/HTTPS. It is much more secure on many levels. (Answer to OP).
-
44I just checked gmail and facebook - chrome developer tools tell me both POST with a urlencoded message containing my username and password in plain (unsalted) text. How/why are the big players not using nonce salting on the client?– gremwellDec 16, 2015 at 8:55
-
40If you don't trust HTTPS every single effort is pointless! Your code itself is shipped through the wire and an attacker can modify/replace all your attempts to to secure password in transit Feb 11, 2017 at 2:08
-
4A MitM that can rewrite a cert can rewrite the nonce. Or what Sajid said.– leewzMar 19, 2017 at 19:27
-
10If you are worried about MITM with HTTPS, what's the point in sending a salt to the client so that the client can salt the password before transmitting the hash back to the server? Seems pointless. Might as well just do an unsalted hash to the server, then use a salt to hash again on the server. Clearly, the client can't be the generator of the client-salt either because the next login, it would be different and not compute the same hash server-side.– crushFeb 4, 2019 at 22:37
-
10This answer has many wrong information, using HTTPS and hashing the password before storing into the server database are enough for most of the cases. For more important accounts, use multi-factor authentication instead of client side hashing. For more information, see: I just send username and password over https. Is this ok?, https security - should password be hashed server-side or client-side? A and Why is client-side hashing of a password so uncommon?.– J3soonApr 5, 2019 at 14:11
Since it's over HTTPS, it's definitely just fine to send the password without hashing (over HTTPS it's not plaintext). Furthermore, if your application is depending on HTTPS to keep it's content secure, then it's useless to hash the password before sending it over HTTPS (i.e. if an attacker can unencrypt the data on the wire, you're screwed anyways)
-
5This shouldn't be a problem. If the client is using a proxy, then all the proxy will see is the HTTPS encrypted data. If you're talking about a man-in-the-middle attack, a properly configured certificate should prevent this. Aug 2, 2010 at 20:03
-
7@Jader: No amount of fiddling with the data will stop a MITM attack, since it can just relay whatever comes to it. It doesn't matter whether you're transmitting a password or hash. That's a completely different matter. Aug 2, 2010 at 20:10
-
2
-
1@carnold - MINTM - What about redirecting to http? Would most people notice? sslstrip - securityfocus.com/brief/910– nate cAug 2, 2010 at 20:38
-
1@Jader Dias your trying to stop a problem that doesn't exist. HTTPS stops this problem, a client side hash does not add any amount of security. The client can never be trusted.– rookAug 2, 2010 at 22:40
No, in fact this would be a vulnerability. If the attacker is able to obtain the hash from the database, then he could use it to authenticate without needing to crack it. Under no circumstance should a user or an attacker be able to obtain a hashes password.
The whole point of hashing passwords is to add an extra layer of security. If an attacker is able to obtain the hash and salt from the database using SQL Injection or an insecure backup then he has to find the plain text by brute forcing it. John The Ripper is commonly used to break salted password hashes.
Not using https is a violation of the OWASP Top 10: A9-Insufficient Transport Layer Protection
EDIT:
If in your implementation you calculate a sha256(client_salt+plain_text_password)
and then calculate another hash on the server side sha256(server_salt+client_hash)
then this is not a serious vulnerability. However, it is still susceptible to eavesdropping and replaying the request. Thus this is still a clear violation of WASP A9. However, this is still utilizing a message digest as a security layer.
The closest thing i have seen to a client-side replacement for https is a diffie-hellman in key exchange in javascript. However, this does prevent active MITM attacks and thus is till technicality a violation of OWASP A9. The Authors of the code agree that this is not a complete replacement for HTTPS, however it is better than nothing and better than a client-side hashing system.
-
7Actually I would hash it again in the server, so please edit your answer contemplating this scenario. Aug 2, 2010 at 20:00
-
@Rook is using diffie-hellman key exchange together with https is a "useless" solution ? ( I mean we can only use https and diffie helman do not increase the security imao ) Dec 3, 2012 at 8:39
-
@Michel Kogan a DH key exchange can be used in HTTPs along with other tools.– rookDec 3, 2012 at 16:22
-
1@Rook It is a best practice to apply a hash on the server, so I think you should update the beginning of your answer not to dismiss client-side hashing, and only then mention that the server's stored hashes and salts should never be exposed. May 27, 2014 at 10:09
Sending a hash over the wire completely defeats the purpose of the hash, because an attacker can simply send the hash and forget about the password. In a nutshell, a system that athenticates using a hash in clear text is wide open and can be compromise with nothing more than network sniffing.
-
3This seems total bullsh... How is a hash less secure than a password? May 27, 2014 at 10:11
-
2This is only true for "dumb" hashes. Consider this: A server sends a salt S to the client and the client does HASH(S + PASSWORD), and sends it to the server. The server honors that specific hash only for the current session. An attacker can indeed send the hash and forget about the password, but ONLY FOR THE CURRENT SESSION. Therefore it's more secure than plain-text. Jun 11, 2014 at 8:38
-
Update: Digest Access Authentication is even more sophisticated: en.wikipedia.org/wiki/Digest_access_authentication Jun 11, 2014 at 8:53
-
2Just to be clear: when I say "defeats the purpose of hash" I'm referring to common and secure practice of hashing passwords before storing them in a database. Nevertheless the argument holds that sending a hashed value instead of a password does nothing to enhance security without additional steps. Jun 11, 2014 at 14:42
-
Just to add to what Paul said: this kind of attack is called a “replay attack” if anyone wants to read more about it elsewhere.– user376845Feb 24, 2019 at 10:16
The password in plaintext show never (not even when using HTTPS) leave the client. It should be irreversibly hashed before leaving the client as there is no need for the server to know the actual password.
Hashing then transmitting solves security issues for lazy users that use the same password in multiple locations (I know I do). However this does not protect your application as a hacker that gained access to the database (or in any other way was able to get his hands on the hash) as the hacker could just transmit the hash and have the server accept it.
To solve this issue you could of course just hash the hash the server receives and call it a day.
My approach to the issue in a socket-based web application I'm creating is that on connection to the client the server generates a salt (random string to be added before hashing) and stores it on the sockets variable, then it transmits this hash to the client. The client takes the users password, hashes it, adds the salt from the server and hashes the whole thing, before transmitting it to the server. Then it's sent to the server which compares this hash to the hash(hash in the DB + salt). As far as I know this is a good approach, but to be fair I haven't read a lot on the topic and if I'm wrong about anything I'd love to be corrected :)
Disclaimer: I'm by no stretch a security expert-- and I'm posting with the hope that others will critique my position as overly cautious or improvable and I will learn from it. With that said, I just want to emphasize that hashing when it leaves your client doesn't mean you get to don't have to hash on the backend before putting it in the database.
Do both
Do both because:
Hashing on the ride over helps cover vulnerabilities of transport, if SSL connection is compromised, they still can't see the raw password. It won't matter in terms of being able to impersonate authorized users, but it will protect your users from having their passwords read in association w/ their email. Most people don't follow best practice and use the same password for many their accounts, so this can be a serious vulnerability to your visitors.
If someone, somehow was able to read passwords from the database (this does happen, think SQL injection), they still won't be able to execute privileged actions impersonating users through my API. This is because of hash asymmetry; even if they know the hash stored in your DB, they won't know the original key used to create it and that's what your auth middleware uses to authenticate. This is also why you should always salt your hash storage.
Granted, they could do a lot of other damage if they had free rein to read what they want from your database.
I just want to emphasize here that if you do decide to hash the key before departure from your clients, that isn't enough-- the backend hashing is, imo, much more important and this is why: If someone is intercepting traffic from your client, then they will see the contents of the password
field. Whether this is a hash, or plain text, it doesn't matter-- they can copy it verbatim to impersonate an authorized client. (Unless you follow the steps which @user3299591 outlines, and I recommend you do). Hashing the DB column, on the other hand, is a necessity and not at all difficult to implement.
Use HTTP Digest - it secures the password even over http (but best useage would be http digest over https)
Wikipedia:
HTTP digest access authentication is one of the agreed methods a web server can use to negotiate credentials with a web user (using the HTTP protocol). Digest authentication is intended to supersede unencrypted use of the Basic access authentication, allowing user identity to be established securely without having to send a password in plaintext over the network. Digest authentication is basically an application of MD5 cryptographic hashing with usage of nonce values to prevent cryptanalysis.
Link: http://en.wikipedia.org/wiki/Digest_access_authentication
If you want to see a "real life" use, you could look at phpMyID - a php openid provider that uses http digest authentication http://siege.org/phpmyid.php
.. or you could start from the php auth samples at http://php.net/manual/en/features.http-auth.php
Http digest rfc: http://www.faqs.org/rfcs/rfc2617
From my tests all modern browsers support it...
-
HTTP Digest implements what I meant in this question, but would we have any advantage if we used HTTPS Digest (SSL + HTTP Digest) ? Aug 2, 2010 at 20:21
-
One main difference would be that everything is sent/received encrypted - http headers send and received and the html reply. To someone randomly trying to "hack" ssl using a man-in-the-middle-attack the http digest would be an extra motive to make him search another easier target, or if he is logging all captured traffic your passwords is still safer. I may have misunderstood the question, english is not my first language.– vlad b.Aug 2, 2010 at 20:54
-
Hash over password has one big advantage: if the traffic is logged or captured somehow it will make the job harder for that person. Also, with http digest, if ssl is not always required, you could let users choose between http and https. Or you could use different protocols for diferent servers (for example i do not enforce https to view/modify less importand data (username, avatar uploading) but enforce https on billing and other parts of the site (that way i can decrease the load on some servers, if/when needed).– vlad b.Aug 2, 2010 at 20:58
If you're looking to replace a clear-text password over HTTPS with a hashed password over HTTP then you're asking for trouble. HTTPS generates a random, shared transaction key when opening up a communication channel. That's hard to crack, as you're pretty much limited to brute forcing the shared key used for a (relatively) short-term transaction. Whereas your hash can be just sniffed, taken off-line and looked up in a rainbow table or just brute forced over a long amount of time.
However, a basic client-side password obfuscation (not hash) sent over HTTPS does have some value. If I'm not mistaken this technique is actually used by some banks. The purpose of this technique is not to protect the password from sniffing over the wire. Rather, it's to stop the password from being usable to dumb spying tools and browser plug-ins that just grab every HTTPS GET/POST request that they see. I've seen a log file captured from a malicious website that was 400MB of random GET/POST transactions captured from user sessions. You can imagine that websites that used just HTTPS would show up with clear-text passwords in the log, but websites with very basic obfuscation (ROT13) as well would show up with passwords that are not immediately of use.
-
"but websites with very basic obfuscation (ROT13) as well would show up with passwords that are not immediately of use" - this contradicts the original statement. The key is that they are not IMMEDIATELY of use, but that really is futile. The password and its ROT13 are equivalent. BUT if you SHA2 the password, it will not be present in the logs (so your admins do not get to know users' possible passwords to other systems), and you're NO LONGER in violation of almost every privacy Act. May 27, 2014 at 10:06
Whether there's an advantage, and whether it's more (or less) secure really depends on implementation. There's arguably some advantage, but if you implement it poorly, you could definitely create a solution that is less secure than passing even a plaintext password.
This can be looked at from the perspective of two types of attacks-- one with access to the network traffic, and another with access to the database.
If your attacker can intercept the plaintext version of the network traffic, then seeing a hash of the password is more secure than seeing the password in plaintext. Although the attacker could still log in to your server using that hash, it would require a brute-force crack (sometimes pre-computed) of that hash to determine the password that might be useful on other systems. People should use different passwords on different systems, but often don't.
If an attacker gained access to the database, perhaps through a copy of a backup, then you'd want to ensure that one couldn't log in with only that knowledge. If, for example, you stored a hash salted with the login name as hash(login_name+password)
, and you passed that same hash from the client for direct comparison, then the attacker could pick a user at random, send the hash read from the database and log in as that user without knowing the password, increasing the scope of the breach. In that case, sending the password in plaintext would have been more secure because the attacker would need to know the plaintext in order to log in, even having a copy of the database. This is where implementation is key. Whether you send a plaintext password or a client-side hash of that password, you should hash that value at the server-side and compare that hash with the hash stored in the user record.
Concepts to keep in mind:
- You "salt" a hash by mixing in some scope-unique value to your hash, typically row-unique. Its purpose is to guarantee uniqueness of hashes from each other even if the plaintext values they represent are the same, so two users with the same password would still have different hashes. It's unnecessary to treat a salt as a secret.
- When authenticating, always hash on the server-side whatever value you pass from the client as a password (even if it's already hashed) and compare it with a pre-hashed value stored on the database. This may necessitate storing a double-hashed version of the original password.
- When you make a hash, consider adding a server/cluster-unique salt to the hash as well as a row-unique salt to safeguard against matching any pre-computed hashes in lookup tables.
If you're connected to an https server the data stream between the server and browser should be encrypted. The data is only plain text before being sent and after being recieved. Wikipedia article
-
1
-
As I understand it they do, but the proxy is not responsible for encryption/decryption and unless it is an unscrupulous proxy only passes the data on. The encryption type and strength is dependent on what the server and client can both support.– jacAug 2, 2010 at 20:17
-
1Even if the proxy is unxrupulous, it can't decrypt the data as it is encrypted using the server's public key. The only way a proxy can decrypt the data is to spoof the server's certificate with a different key Aug 2, 2010 at 20:32
-
@Jader. If they did, it would make HTTPS pretty lame. when you authenticate to a server with HTTPS, you are getting a guarantee (assuming the certificate is valid) that you are connecting to a certain server, and have an encrypted path from one end to the other. Hypothetically, a man in the middle attack could be done to fool you of course, but that is not the same as a basic web proxy. Aug 2, 2010 at 20:44
If you want to achieve the same reliability as when transferring over https, then yes - one option - the implementation of an asymmetrically encrypted channel at the ajax level.
If we are not talking about registration (for example, the first transmission of the password is always protected), then there are options.
For example,
- The server generates a random string and generates a salt sends it to the user.
- The user calculates a hash from his password and using this hash as a key encrypts this random string with a blowfish, for example (there is an implementation in JS for sure) and sends it back to you.
- You, on your own, using the hash stored on the server, also encrypt this random string with a blowfish.
- Compare.
An attacker would have to attack the bluefish key using a random source and ciphertext. The task is not easy.
-
This is about verifying passwords (no need to send a hashed password, but you send a hashed random string back to server)– M22Apr 10, 2021 at 21:52
Isn't SSL/TLS replacing the nonce? I don't see added value of this since SSL/TLS also protects against Replay Attacks.
It would actually be less secure to hash the password and send it over a non-encrypted channel. You will expose your hashing algorithm on the client. Hackers could just sniff the hash of the password and then use it to hack in later.
By using HTTPS, you prevent a hacker from obtaining the password from a single source, since HTTPS uses two channels, both encrypted.
-
1Actually I would hash it again in the server, and I would use HTTPS anyway, so please edit your answer contemplating this scenario. Aug 2, 2010 at 20:02
-
@Jader, the point is, all an attacker needs now is the first hash, rather than a password. In effect, the hash you take of the password on the client side is now just as useful as the password itself. So you're not really gaining much security. Aug 2, 2010 at 20:39
-
has anyone ever thought of not sending parts of the token? like if you know your methods of hashing, why would you send that. shouldn't the server know the client key to decrypt?– jemiloiiJul 15, 2017 at 0:32