You are making an unfounded assumption that the password is sent to the client which does the check and then shows the message rather than the server doing the check and responding with the message back to the client.

[–] aesthelete@lemmy.world 1 points 1 month ago (3 children)

Nah I'm not, look above. There's a way to do this that isn't terrible. I just kinda assume that they aren't doing it properly because I've worked in software for decades.

[–] Clent 1 points 1 month ago (2 children)

No one is reimplementing their hashing algorithm in JavaScript. Doesn't matter how many decades in the industry you have, that's a silly assumption.

The parts of security here that involve best practices are invisible to the user. Things such as salting which many do not do but also how they handle the reset token which many do not think about.

However, none of that makes a good meme for people cosplaying cyber security gurus.

[–] Vigge93@lemmy.world 1 points 1 month ago

You would assume that, but you would be very wrong. People are lazier/sloppier than you might think.

Searching for "client side authentication NVD" turns up a lot of examples. There is even a CWE for "Use of Client-Side Authentication:

https://cwe.mitre.org/data/definitions/603.html

load more comments (1 replies)