• Vigge93@lemmy.world
    link
    fedilink
    arrow-up
    11
    ·
    1 month ago

    That would be an extremely bad idea tho, because it would allow a malicious attacker to

    1. Try random usernames, and if the website returns a hash they know that user exists
    2. Once they have the hash, and the hashing algoritm, it is much easier to brute-force the password, bypassing any safeguards on the server

    Username/password validation should happen entirely server-side, with as little information as possible provided to the client

    • aesthelete@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      1 month ago

      Username/password validation should happen entirely server-side, with as little information as possible provided to the client

      💯

      It’s recommended practice to not even tell them which half of the username/password combination failed upon authentication failures.