Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The problem with the approach you mention is that clientside bugs can evilly break things. If the clientside code silently gives wrong results, not only will you not know, but, assuming they run it from the start (i.e. when they register), it will actually "work" - until the client moves to another machine or updates. That's not a good situation.

You may be able to detect this with testing, but not necessarily. And yes, it'll probably happen sooner or later, given the nature of JS compilers.

I don't know if there's a method that avoids this problem that still has the advantages that you mention.



If you're worried about this, you could do server-side hashing during signup, and client-side hashing during login.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: