Edit: obligatory explanation (thanks mods for squaring me away)…

What you see via the UI isn’t “all that exists”. Unlike Reddit, where everything is a black box, there are a lot more eyeballs who can see “under the hood”. Any instance admin, proper or rogue, gets a ton of information that users won’t normally see. The attached example demonstrates that while users will only see upvote/downvote tallies, admins can see who actually performed those actions.

Edit: Obligatory RIP my inbox.

    • iSoSyS@lemmy.pt
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      I didn’t read the source code too deeply, but it appears the server receives the password, and only then it is hashed. How does it work?

      1. POST -> HTTPS -> SERVER -> hashing
      2. hashing -> POST -> HTTPS -> SERVER

      Is it option 1 or 2 (or other). If option 1 an evil admin can collect the password, or am I misinterpreting something?

      • klausklemens@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        edit-2
        1 year ago

        If the threat is an evil admin who can change the code it doesn’t matter. The admin could change the server code to store unencrypted passwords, they could change the client code to send unencrypted passwords, they could make clients post plaintext passwords whenever you login. Hashing is damage control incase someone absconds with the password database.

      • hughperman@mander.xyz
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        1 year ago

        That code may be client-side code, some of it refers to forms etc. Not familiar with the frameworks though , so can’t say for sure.

        Edit: no, that makes no sense at all, now I look at it again.