Question on logistics of hashing at client

Question

I have found a lot of posts on hashing at the client but none that quite answer my question.

I would like to hash user passwords at the client so that I don't have to send a plain text password across the web but I have a question as to how i might do so successfully when using a salt.

The normal procedure of validating a password is.. 1) user enters username and password 2) recover salt based on username 3) hash password and salt 4) check hash against db

If this all takes place on the server, this is no big deal but it becomes complicated if you are on the client. 2) would have to be a call back to the server while maintaining the password somewhere (without posting it) so.. ajax? Is that the best way or am i missing something?

Thanks in advance!

Answer 1

Sending a hashed password over an unencrypted connection is no better than sending the unhashed plain text password. A bad guy can intercept the hashed password and replay that as the credential later.

What you want is to send the real password over SSL.

Answer 2

As a more secure alternative to sending unencrypted hashes or passwords across an unsecured channel (but still less secure than SSL), you might look at Digest Authentification.

As was stated above, sending the hash across an insecure channel would still allow someone else to log on as the user.

Answer 3

Thanks guys, I don't know what I was thinking. Ill check out the Digest.