pre-hash

So I’m working on a project, and I’m a bit curious about something…

Would it make sense for me to use http://caligatio.github.com/jsSHA/ <- jsSHA and hash the password before it even hits the server? Obviously the site would use SSL but would pre-hashing make any sort of difference?

A properly configured SSL connection is enough. And what would you encrypt on the server-side? An already encrypted hash? Because you want to keep the server-side encryption on, in case the user disables Javascript on his browser.

Then you’d end up having single (when the user browser’s JS is disabled) and double-encrypted hashes in your password database, and you’d have to either keep track of that (for later when you want to validate a log in, for example), or extend your initial password storage logic to double encrypt the password in case the user’s request comes from a JS-disabled browser.

Messy.

I think this jsSHA library would be more useful for server-side JS (i.e. a nodejs-based web framework).

As TheRedGiant said very well, security wise, don’t trust anything to rely on client side! That must definitely be for a server side JS!

a sniffer could still capture the hash, and then use that hash to login to that system as that user. only benefit could be if not using SSL , couldn’t capture the raw password. you’ll also have to fall back to a non-hashed non-javascript mode for certain browsers and mobile devices.

eduvoindo said
As TheRedGiant said very well, security wise, don’t trust anything to rely on client side! That must definitely be for a server side JS!

Actually the plan was to add a salt and re-hash once it was on the server, but dtbaker has a point.