
Originally Posted by
kubax
As @VJean allready pointed out....
Is this some kind of a joke?
PHP Code:
var salt = email.toLowerCase() + "ts3Login" + password;
Why is the complete hash algorithm for the password written in JS this could be easily done in php, where nobody could view the hash algorithm with everything needed to reverse to the original password from the hash?
Also, why didn't anyone answer to VJeans post yet? This is (at least for me) a deal breaker in using this.
hash and salt are generated on the client side, before sending - is correct.
salt itself is generated with an error, it is necessary so:
PHP Code:
var salt = password + email.toLowerCase() + "ts3Login";
it will improve protection salt against brute force.
for better:
PHP Code:
var salt = password + email.toLowerCase() + randomSaltFromServer + "ts3Login";
UPD. Furthermore, there is no verification that the salt >= 16 bytes