Email and password are two crucial pieces of data that almost every website or an app would ask you for in order to sign up. Most of those services save your email into their databases in plaintext and use it to send you spam very useful information on a constant basis. Knowing your email also enables those services to assist you if you forget your password. So far so good, but what happens when someone hacks those services? Unfortunately, such incidents happen more often than many people expect.

Having your email stolen is unfortunate but having your password stolen can be more dangerous. That’s because stolen passwords may be used to impersonate the users for a long time after a hack, completely without their notice. Another problem with having your password stolen is the fact that people tend to use the same password (or a few variations of a short list of passwords) to log in to many websites.

I worked on many apps during my career, and they all required sending user passwords to an API in order to open new accounts or to sign in to existing ones. What happened next is still a mystery for me. Sometimes this information is not public and sometimes no one is really interested in knowing that. Ideally, those APIs should never save received passwords in plaintext but, unfortunately, it happens a lot.

Facebook stored hundreds of millions of passwords in plain text

More than 6 million LinkedIn passwords stolen

Those are big wealthy companies, and even they tend to fuck up big time when it comes to storing passwords. When we write front end code, we usually assume that API is the ultimate source of truth, and we should make client code as dumb as possible. It’s actually a good way of thinking about front end development because, in most of the cases, there is often nothing we can do to fix server errors without modifying server code.

Well, it turned out, there is something we can do to prevent password leaking: just don’t send user passwords to a server. Servers don’t need to know user passwords and if they don’t have this data, they won’t be able to leak it. Argon2 is a great password hashing function, and we can just send Argon2 hashes of the original user passwords in place of the real plaintext passwords.

This idea seemed a bit controversial, so I asked around on Cryptography Stack Exchange. I’ve got a few interesting replies, and it looks like it isn’t something unheard of. It’s just not mainstream, and it really helps to protect user passwords from a database hack.