16 ms·
The point is that you only send the hash to the database to connect. If you steal the hash, you can connect to the database using said hash, not needing the pla
by jhgg 10y ago
The point is that you only send the hash to the database to connect. If you steal the hash, you can connect to the database using said hash, not needing the plaintext. The password might as well be the hash in this case. Hence the equivalency.
Using that scheme, all you prove is that you know the hash of the password. SCRAM allows you to prove you know the plaintext password without actually transmitting it.
- xyzzy_plugh 10y agoIf you steal the hash from the database, yes. I don't know how stealing the hash over-the-wire is equivalent to having the password, since it is salted (with a salt generated by the server) and is not reusable.
- MBCook 10y agoBecause the next time you connect to the server you provide the same hash. The person doesn't know your plane text, but they can get into the server just fine.
- xyzzy_plugh 10y agoYou can't provide the same salted wire hash. You'd need the pre-salted hash, which only the client and server now. I fail to see how this answers my question.