Client side password hash versus plain text

后端 未结 2 1663
悲哀的现实
悲哀的现实 2020-12-06 21:45

I\'m putting together an android client (and possibly in the future iOS, web portal, etc) and php mysql server. Server side I am currently using the PHPass library to hash a

2条回答
  •  孤城傲影
    2020-12-06 21:58

    Another disadvantage of hashing passwords on the client is that you cannot change the hashing algorithm or iteration count without also having to update your clients.

    For JavaScript clients that is not a problem, but you cannot easily guarantee that your users will be on the most recent version of your native client.

    So I would stick with sending plain passwords over HTTPS.

提交回复
热议问题