Is it a bad idea to send the hash of a password instead of the unhashed password?

Question

For example, if the user has JavaScript enabled, we send hash his password and send the hash. If not, we send the password unhashed and a flag to mark that it is unhashed. We then build the hash (if it's unhashed) and compare it to the stored hash.

This seems to be secure and simple. Why isn't it a popular way to send a password? Did I miss something?

In another word: why better is lose hash then unhashed password? (imo most of us have only few passwords to many sites)

Answer 1

Note, that if you only hash the password, the hash is going to be exactly the same each time.

You should rather use some kind of challenge/response mechanism similar to APOP in POP3 protocol

Answer 2

Then I just wiretap the hash and log in with that?

If you're concerned about security you should be using SSL. Then you can just send the password as is.

Also, SSL proves that the server they're logging into is not someone impersonating you.

Answer 3

JavaScript can always be tampered with. By hashing the password using JavaScript you at least are exposing your rules on how to store passwords. From a hacker perspective it's the same thing to catch the real password and send it to you system or to catch de hashed password and send it to your system.

If you really need to improve password security I would recommend using https and hashing it at Server side. Don't forget to use a salt key.

Answer 4

See Perl/Javascript MD5 Secure User Authentication for an implementation and discussion.

Answer 5

You're making your job more complex than it is. Just send the password as plain-text, a hash won't improve security in any way. (See other's answers)

If you use the same hashing algorithm for storing the passwords in your databases, you actually decrease security. Because if someone can get the hashed passwords from it, he can use them to authenticate himself. (He doesn't have to dehash them) If you have SQL injection or other information leaking problems on your website, this will be the case.

Answer 6

The real problems here are man-in-the-middle attacks, where someone sniffs what comes down the wire. It doesn't matter if you send the hash of the password or the password itself, if someone downstream can read this, they can log in as that person. The only secure option is to use SSL to stop anyone but the server from being able to decrypt the password-hash/password.