3 ms·
"Since if someone has it, they can just send it to the server for auth" unless it's only good for a few moments (the form you type it into constantly polling fo
by hunter2_ 9y ago
"Since if someone has it, they can just send it to the server for auth" unless it's only good for a few moments (the form you type it into constantly polling for a new nonce).
- jimktrains2 9y agoOr you could just use PAKE or SRP.
- deepbreath 9y agoThe server would not be able to verify a changing hash without knowing the password