10
Passwords sent as plaintext? (infosec.pub)
submitted 3 years ago by to c/infosecpub@infosec.pub
23 comments fedilink hide all child comments
 

I tried logging in on browser and I had inspected the request. My password was sent in plaintext. Is this a infosec.pub issue or a Lemmy one?

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 3 years ago (2 children)

Not the original commenter but if someone is listening in on your connection it doesn't really add any security. The hacker would be able to just send the hashed password instead of the plain text and would be able to login.

The hashing algorithm would be public facing so its easily reversible anyway.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 3 years ago

    The first paragraph is correct, but your second paragraph is not. A cryptographic hash function is a lossy one-way function. Knowing exactly how something was hashed does not mean you can turn the hash back into the starting value again.

  • permalink
  • fedilink
  • source
  • parent