Re: Re: Do you trim() usernames and passwords?

Joshua Kehn wrote:

On Dec 28, 2010, at 3:18 PM, Dotan Cohen wrote:

I'm toying with the idea of having the passwords hashed twice: they're already in the database hashed, and javascript hashes them on the client before sending them over, but I'm thinking about sending an additional salt to the client to hash the hashed passwords with salt, and that's what is sent back. This way, each login is done with a different hash of the password so an attacker cannot simply capture and reuse the hashed password. But before all that goes on, I have to decide what to do about leading and trailing spaces.

Toy with it and discard it. Client side hashing / salting is not a good idea. A much better alternative is to use SSL.

indeed, and on reflection, if you're putting this much effort in to it, and security is a worry, then forget username and passwords, and issue each user with a client side RSA v3 certificate and identify them via the public key of the cert.