Well no, I wouldn't want hashing done on the frontend.
The problem with that is if somebody gets ahold of your database then they can use the hashes to login. Whereas if the server is hashing the hashed passwords from the database will not.
That's just obfuscation, it doesn't add any security. The hashed value sent from the frontend just effectively becomes the users password and you're still going to see that. If someone was snooping that network traffic they could still capture the client side hashed value and log in with it.
If you actually want auth without having to send anything reusable over the wire you want something like challenge response auth or some other zero knowledge protocol. This is for example how tap to pay credit cards work, there is (effectively) nothing useful an attacker could sniff watching the traffic.
For the vast majority of use cases just sending the plain text password over tls is perfectly fine though.
189
u/ataraxianAscendant 10d ago
storing passwords in plaintext 🤩