Passwords sent as plaintext? (infosec.pub)

submitted 1 year ago by [email protected] to c/[email protected]

23 comments fedilink hide all child comments

I tried logging in on browser and I had inspected the request. My password was sent in plaintext. Is this a infosec.pub issue or a Lemmy one?

you are viewing a single comment's thread
view the rest of the comments

[-] [email protected] 3 points 1 year ago

Not the original commenter but if someone is listening in on your connection it doesn't really add any security. The hacker would be able to just send the hashed password instead of the plain text and would be able to login.

The hashing algorithm would be public facing so its easily reversible anyway.

[-] [email protected] 6 points 1 year ago

The first paragraph is correct, but your second paragraph is not. A cryptographic hash function is a lossy one-way function. Knowing exactly how something was hashed does not mean you can turn the hash back into the starting value again.

[-] [email protected] 2 points 1 year ago

Oh okay makes sense thanks!

Why would the hash be reversible? SHA256 is public and it's not reversible

this post was submitted on 18 Jul 2023

10 points (81.2% liked)

Discussions related to Infosec.pub

1121 readers

1 users here now

founded 1 year ago

MODERATORS

[email protected]