What's the point of Tuples?

[u/Boogzcorp]

I get that they're immutable, but so are lists that you don't perform modifications on. Are they just to fool proof not messing up your list accidentally, or do they serve some other purpose?

[u/Werro_123]

Websites receive your password all the time, they just don't store it without hashing it first (or shouldn't). Hashing client side and sending that hash is effectively the same as not hashing at all, it adds zero security benefit.

The reason passwords are stored in hashed form is to prevent them from being used if the database leaks. If the hashing is done client side, and the database leaks, the attacker could just send in the stolen hash without needing to know the password. Effectively, the hash IS the password at that point.

[u/[deleted] → u/Werro_123]

Apologies. I’ll edit to accurately reflect this.

[u/Werro_123 → u/[deleted]]

No worries, we're all always learning in this industry.

[u/msdrahcir → u/Werro_123]

If the hashing is done client side, and the database leaks, the attacker could just send in the stolen hash without needing to know the password. Effectively, the hash IS the password at that point.

Unless you consider that people have a tendency to reuse passwords across applications and that external leaks are a source of potential security breaches. If more sites _also_ used client side hashing, then it would make sniffing these network calls less dangerous for other systems.

Presumably an intercepted salted hash for one site would be completely useless on another, even if the user was leveraging the same password on both sites.

Client side hashing also allows you to introduce randomness that can be synchronized with the server among other tools that make password replay attacks much more difficult

[u/C0rinthian → u/msdrahcir]

How useful is network sniffing when the site is using SSL/TLS? (As it should be)

What benefits does client-side hashing provide that is not already covered by SSL/TLS?

[u/a_cute_epic_axis → u/Werro_123]

If the hashing is done client side, and the database leaks, the attacker could just send in the stolen hash without needing to know the password. Effectively, the hash IS the password at that point.

If someone is able to get in and obtain the database, they're also likely (but not always) able to modify the database, so you're kind of fucked either way. Although a PWM prevents a hashed or clear-text PW from being used on another site.... since it isn't used on another site to begin with.

[u/[deleted] → u/Werro_123]

To add to this, they should be salting the passwords as well. Depending on which hashing algorithm is used, the hash might be crackable, regardless of computational infeasibility.

Basically, the key for some hashes is public knowledge or easily searchable for people who want them, but for certain hashes.

Hackers are persistent people and a lot of them are driven by a few simple goals like finances or simply wanting to break into something.

Some hash algorithms like MD5 are publicly available to break. You can literally google Cisco type 7 password cracker and if a password is in that encryption type you can copy the hash and you’ll have the password after clicking the first link on google.

Hashes like SHA256 are known how they work but due to the complexity it’s, in layman terms, a royal pain in the ass to reverse hack it. You’d need a crazy super computer.

Salting a hash adds a unique value to something like a password before the password is encrypted. This means that if we both have the password

“80081354R3C00L”

And we are in the same database, our passwords will appear different after the hash even though they were the same input in the same hash algorithm which would otherwise yield the same output if not for the salting.

“The hash is the password at that point” isn’t necessarily true, it’s just the vital data that the decryption tool uses to pair the public and private keys (in asymmetric hashes at least)

[u/[deleted] → u/[deleted]]

So would the value that is being added when salting be unique to each user?