1
$\begingroup$

Suppose we visit https facebook.com for the very first time. We are creating a new account and creating a password. Then we send then password to the server, the server receives this and only then hashes it.

All consequent log-ins, you won't have to send your password as a plaintext, it will be sent as a hash and the server will compare the stored hash and the hash you've sent. If they match up, it means you know a password.

But interesting thing happens. When we create a password we need to send a password to the server as a plaintext for the very first time in order for the receiver to hash it and store.

What if someone intercepts the data at this time? What am I missing here?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ The passwords do not just need to be protected during transit, they also need to be protected during storage. E.g. you don't want all the passwords to be visible or easy to guess if the storage device is stolen. You may also want to protect them when send, e.g. to avoid them being made part of a log file etc. However, I'm hoping CodesInChaos steps in because of his involvements with the password hashing competition. $\endgroup$ – Maarten Bodewes♦ Mar 4 '18 at 16:56
  • $\begingroup$ In the mean time, if you've got more information about the exact protocol that Facebook uses then please include it or provide a link to it. $\endgroup$ – Maarten Bodewes♦ Mar 4 '18 at 17:05
1
$\begingroup$

First, you don't actually send a hash on subsequent connection attempts, you still send the plaintext password. Second, even if you would send a hash, the same hash, every time, this hash would effectively be your new password.

Now for your actual question:

What if someone intercepts the data at this time? What am I missing here?

The fact that HTTPS is used. HTTPS stands for HTTP-Secure, which means it's HTTP over TLS. Now if your browser properly validates the data it gets from the server (which all browsers do), then you can be sure that the party at the other end of the encrypted TLS connection actually is facebook.com, at which point you also know for sure that the connection hasn't been intercepted.

It says that plaintext is not secure so servers store only hashes of the passwords. How this works exactly.

Assume we have a secure connection between the client and the server, that is the client knows for sure who the server is (eg facebook.com). TLS achieves this. Now for the registration send the server the username and the password you want to use. The server password-hashes the password and stores it alongside the username. Now on subsequent log-ins you send the password again, the server retrieves some parameters from your username, applies the password hash again and compares the result with the stored value. If they match, you are authenticated, if not, then not.

Why the hashing on the server? Suppose the database of the server where all the password hashes and usernames are stored gets compromised (eg an attacker gets root access to the server or can dump the database using an SQL injection), now if you have stored plaintext passwords, the attacker can immediately use these against your service and any other sevice these users may use (assuming they re-use passwords, many do). Now if you have hashes, the attacker first needs to find inputs that map to these hashes, for this they usually need to try out a lot of passwords, which is infeasible for really good passwords and even for weaker passwords takes a moment of time. So now the passwords aren't complete and utterly compromised when the server's security fails.

|improve this answer
$\endgroup$
  • $\begingroup$ I still can't understand exactly how the hash helps. I'm very new to this stuff. I was reading this en.wikipedia.org/wiki/… . It says that plaintext is not secure so servers store only hashes of the passwords. How this works exactly. Thank you for your reply. $\endgroup$ – D-Samp Mar 4 '18 at 19:08
  • $\begingroup$ @D-Samp I have edited my answer. If you need more detail than this, please comment and I'll do my best to clarify. $\endgroup$ – SEJPM♦ Mar 4 '18 at 19:18
0
$\begingroup$

the server save the Hash value only to protect its data from hacking (stealing), when the hacker steal the hash code he will not benefit from it because it (Hash Code) will be not the password itself when the server hashed it.

|improve this answer
$\endgroup$
  • $\begingroup$ by the way the connection itself is encrypted between the client and server $\endgroup$ – Q.M.J Mar 4 '18 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.