Hacker News Reader

I mean... It sounds like he was right, in the sense that sending passwords verbatim over HTTPS is completely normal and fine.

Obviously (not) logging cleartext passwords is the kind of thing you learn in Security 101.

View on HN

The thing you learn in Security 102 is that you should encrypt passwords in HTTPS anyway, because so much of your middleware will assume fields aren’t secured, and will happily log them — that while from a theory standpoint, password-over-HTTPS is fine, in practice it’s a liability due to organizational issues.

You can securely send plaintext over TLS, but it’s best not to when avoidable — precisely because it’s inviting the disaster above.

Client-side encryption is security theatre. If clients encrypt the password, then an attacker can send a log-scraped hash just as easily as a plaintext one. If anything, the faults (like the one above) would still exist and just become harder to spot.

Reply on news.ycombinator.com