3 ms·
An attacker that would have the ability to impersonate the server could precompute a rainbow table for a given salt, and send that salt to the client. OTOH, wi
by jedisct1 9y ago
An attacker that would have the ability to impersonate the server could precompute a rainbow table for a given salt, and send that salt to the client.
OTOH, without client-side prehashing, an attacker that has the ability to impersonate the server doesn't have to precompute anything in order to collect all passwords.
- Franciscouzo 9y agoIf an attacker is able to impersonate the server, then it is also able to ask the client for the password by modifying the Javascript sent.
- jedisct1 9y agoAll clients are not web browsers, but sure.