Passwords sent as plaintext? (infosec.pub)

submitted 1 year ago by iamak@infosec.pub to c/infosecpub@infosec.pub

23 comments fedilink hide all child comments

I tried logging in on browser and I had inspected the request. My password was sent in plaintext. Is this a infosec.pub issue or a Lemmy one?

you are viewing a single comment's thread
view the rest of the comments

[-] Simran@lemm.ee 3 points 1 year ago

Not the original commenter but if someone is listening in on your connection it doesn't really add any security. The hacker would be able to just send the hashed password instead of the plain text and would be able to login.

The hashing algorithm would be public facing so its easily reversible anyway.

[-] clb92@kbin.social 6 points 1 year ago

The first paragraph is correct, but your second paragraph is not. A cryptographic hash function is a lossy one-way function. Knowing exactly how something was hashed does not mean you can turn the hash back into the starting value again.

[-] iamak@infosec.pub 2 points 1 year ago

Oh okay makes sense thanks!

Why would the hash be reversible? SHA256 is public and it's not reversible

this post was submitted on 18 Jul 2023

13 points (100.0% liked)

Discussions related to Infosec.pub

1128 readers

24 users here now

founded 1 year ago

MODERATORS

jerry@infosec.pub