20
votes
8answers
15k views

Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?

Relevant XKCD There are many sites on the Internet that require login information, and the only way to protect against password reusing is the "promise" that the passwords are hashed on the server, ...
26
votes
14answers
1k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
0
votes
10answers
402 views

Should I provide some way to disable my software post-delivery?

I'm debating the value of putting remote disable (or destruct) functions into my software before delivering it to clients... As a hypothetical example, consider the development of a Silverlight app ...