4 ms·
That’s hardly a best practice and if followed consistently just means that the hash is your actual password, which means if someone steals the hash from a log f
by javagram 8y ago
That’s hardly a best practice and if followed consistently just means that the hash is your actual password, which means if someone steals the hash from a log file they can still impersonate you.
Unless you actually mean some sort of challenge response scheme which is rather uncommon to see, e.g. http “digest” authentication or SRP.
- qpiox 8y agoThe big problem of a service having your true password (instead of the hash of the password) is that many users use the same password for a multitude of services (read Gmail, Hotmail, Yahoo, Amazon, ...) So it's bad practice to keep or transfer the users cleartext password. It should never leave her browser/client. Period.
- javagram 8y agoPassword managers and service specific 2FA solve that problem quite nicely for now (edit: although yes most users aren’t willing to do that).
- aeorgnoieang 8y agoIf the service has only the hash of the password, then that's the password, which would then be subject to the same problems as a "cleartext password".