security - Java SSL Safety -
i have client-server model uses ssl on every connection. have used java , common libraries program this. have 2 questions regarding ssl safety:
1) is considered safe send password in plaintext client server? server uses bcrypt hash password , store it. have considered sending unsalted hash of password or nounced hash of password, more safe sending password in plaintext? doubt it. don't think sending password salted hash viable option, salt need stored somewhere in client or send on network, , don't think make inherently more safe sending password plaintext. due ssl nobody else should able read anyway, right?
2) does encrypted data on ssl gets encrypted different string, , if so, can use earlier encryption of string same result later? clarify:
- if encrypt data now, , few seconds later, procide same cipher text?
- if use cipher text encrypting "test", can send same cipher text on later moment let server believe client legitly sent "test"?
under circumstances assumption should made not want approach own (client or server) perspective, want approach hacker/cheater's point of view.
regards.
i'll answer way. ssl has privacy, integrity, , authentication.
- privacy: no-one can read traffic.
- integrity: no-one can modify, inject, replay, or truncate traffic without detection.
- authentication: @ least 1 of peers reliably authenticated other.
(1) disposes of first question. (2) disposes of second question.
Comments
Post a Comment