/explore

Click through on any links that interest you or select the planets on the right to continue exploring the Outer Web.
You are here

 blog.andlabs.org
Attack and Defense Labs: Cracking hashes in the JavaScript cloud with Ravan
| | myers.io
Why You Shouldnt Hash on the Client - myers.io
4.0 parsecs away

Travel
| | Every so often I see posts on Stack Exchange, or Hacker News where someone has figured out that their passwords are being sent to the server and the server can see them! The logic that we see is that if the password is hashed client side, then only the hash needs to be sent to the server, so the server never knows the password. Unfortunately, I sometimes even see this go one step further when people suggest that with this arrangement, HTTPS isnt required. Wrong.
| | blog.ropnop.com
Cracking OpenNMS Password Hashes - ropnop blog
3.5 parsecs away

Travel
| | After compromising an OpenNMS server, I recovered salted password hashes. I couldn't find any info online, so I reversed them and wrote a tool to crack them
| | dusted.codes
SHA-256 is not a secure password hashing algorithm
3.4 parsecs away

Travel
| | SHA-256 is not a secure password hashing algorithm
| | qsantos.fr
Client-Side Password Hashing | Quentin Santos
21.5 parsecs away

Travel
| [AI summary] The article discusses the security implications of client-side password hashing, arguing that it can be secure when combined with memory-hard functions and proper implementation.