Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.c++ > #72069
| From | David Brown <david.brown@hesbynett.no> |
|---|---|
| Newsgroups | comp.lang.c++ |
| Subject | Re: Regal eagle / American cloud |
| Date | 2020-03-01 14:46 +0100 |
| Organization | A noiseless patient Spider |
| Message-ID | <r3geba$u4e$1@dont-email.me> (permalink) |
| References | (6 earlier) <r3ct34$18p9$1@gioia.aioe.org> <fwn6G.54127$_h7.15094@fx13.ams1> <r3d0kv$1nc1$1@gioia.aioe.org> <DRn6G.1466760$GFe.1466664@fx12.am4> <_to6G.60660$4z5.47573@fx30.ams1> |
On 29/02/2020 08:34, Mr Flibble wrote: > On 29/02/2020 06:51, Melzzzzz wrote: >> On 2020-02-29, Chris M. Thomasson <chris.m.thomasson.1@gmail.com> wrote: >>> >>> Okay. I was thinking of sending an encrypted password using a DH secure >>> channel. We can most certainly hash on the client, then send the digest >>> to the server using a secure DH? >> >> When using encrypted protocol it is same. When attacker has hash it is >> same as plain text. > > You are missing the point: people use the same password for different > things: if the hash is compromised it only compromises access to this > particular server; also > you cannot gaurantee that lemons working on the server code don't log it > by mistake. NEVER send password in the clear from the CLIENT computer > even over encrpypted links. > Clue: you can hash a hash. > Exactly. It is always surprising how many people miss this point. (And it should be needless to add that you should pick a good, random salt.) The bad guys don't break into Facebook, Google, banks, and the like by hacking those servers and reading out their data. They break into some numpty web site that has stored user names, email addresses and clear text passwords (because the muppet running them thinks Wireguard or DH is magic that keeps it all safe). Then they guess that the user has the same password on other services. In virtually all cases, a standard https connection is secure enough for transferring the password hash from the client to the server. It is almost certainly better than making up your own system because you have heard that Diffie-Hellman key exchange is good, or because you have read about Wireguard while totally misunderstanding its purpose. And after the initial transfer of the hash, you never have to transfer it again, meaning the bad guys only have once chance to eavesdrop on it.
Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-09 12:54 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-27 20:19 -0800
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-28 16:50 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:34 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:37 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-28 16:24 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 03:48 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 21:33 -0800
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 06:28 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 22:34 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:51 +0000
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 07:34 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:40 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 14:46 +0100
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-01 12:59 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 22:47 +0100
Re: Regal eagle / American cloud red floyd <no.spam@its.invalid> - 2020-03-01 22:14 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-03-03 08:06 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:21 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:24 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-03 08:11 +0100
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:31 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:33 -0800
exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 08:24 -0800
Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 10:26 -0800
Re: exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 11:00 -0800
Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 13:17 -0800
Re: exception with distinct data members and concatenated what Paavo Helde <myfirstname@osa.pri.ee> - 2020-12-08 22:13 +0200
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:38 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:50 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:32 -0800
csiph-web