3 ms·
If the salt is static, the hash becomes the password. Nobody does this. If the hash is dynamic, the password has to be stored in plaintext. Kerberos does somet
by dbt00 7y ago
If the salt is static, the hash becomes the password. Nobody does this.
If the hash is dynamic, the password has to be stored in plaintext. Kerberos does something like this.
Neither of these are better than the current state of the art. Read up on SRP for a public-key based system that does something like what you want.
Third party data access should go through OAuth, not by sharing passwords to services.
- megous 7y agoPeople share passwords, and use e-mail address to create accounts on all kinds of websites. Anything that would prevent the website's server from getting the plaintext password would be good. Salted hash is obviously not a plaintext password and can't be stuffed around to other services.