3 ms·
Because then the hash of the password becomes equivalent to a password - a malicious actor that learns the hash of the password can just use that to log in to t
by caf 8y ago
Because then the hash of the password becomes equivalent to a password - a malicious actor that learns the hash of the password can just use that to log in to the service (since they can just choose to send it to the server).
- gpm 8y agoYou're absolutely right. But it means that they can't use the password to build a dictionary, to log in to other services, etc. (Assuming the password is complex enough that the hash isn't reversible)