As a developer with a passion for coding, rather than a security expert, I came across The definitive guide to form-based website authentication, which highlighted the importance of SSL or complex algorithms in safeguarding login data from eavesdropping. Despite my lack of expertise in computer security, I fail to spot any glaring flaws in the following authentication method:
- When the login button is pressed, the client requests a lengthy random string from the server via JavaScript.
- The client then hashes both the random message and the password (which has not been transmitted).
- Using blowfish or another encryption algorithm, the client encrypts the hash of the random message with the password hash.
- The resulting encrypted data is sent to the server by the client.
- On the server side, the message is decrypted using the password hash stored in the database (as only hashes are kept, not actual passwords).
- If the decrypted hash matches the original message hash, the client is authenticated.
What am I missing here? The password nor its hash are ever transmitted over the network, with the server solely storing password hashes...