2 ms·

Man in the middle attacks fetching for plaintext passwords -- edit: using a KDF would improve it even more.

by consp 9y ago

anonymouz 9y ago
If the client only sends the hash to the server, a MitM also only needs to capture the hash.
croon 9y ago
Sure, but if they've MITM:ed your trusted certs, aren't you already boned in so many ways?