5 ms·
> You're still passing the output to the server, which can be repeated. Not if the server generates a unique ID for each attempt, and that ID must be used in h
by imaginenore 11y ago
> You're still passing the output to the server, which can be repeated.
Not if the server generates a unique ID for each attempt, and that ID must be used in hashing. It can be as simple as a timestamp.
- k3d3 11y agoWhich is then going beyond just using scrypt on the client. What you explain is simply challenge-response authentication.