3 ms·
If the server requires me to send it the md5 of my password (for example), it still has to store something to validate the password, which can then be cracked.
by ryan-c 9y ago
If the server requires me to send it the md5 of my password (for example), it still has to store something to validate the password, which can then be cracked.
- nine_k 9y agoSure, the server should expect a bcrypt hash, and only store a bcrypt hash. OTOH maybe requiring client to compute the hash is sometimes too drastic. Sending the password to the server via a properly encrypted channel (https) may be fine, provided that the server never stores it, and just uses it to compute a hash for comparison. Then my original point does not hold.