3 ms·
I'm stipulating that we use a salt, so the (password+websitesUniqueSalt) equals a different hash each time.
by tomglynch 7y ago
I'm stipulating that we use a salt, so the (password+websitesUniqueSalt) equals a different hash each time.
- smolder 7y agoMost people wouldn't do that because it's effectively redundant if you trust TLS and that the server is not compromised. However I think your proposed technique would be useful in cases where TLS is broken or the server is in some way compromised, running on low trust hardware, etc. So it's a good precautionary measure. Grandparent is also right that your users password can still be compromised on other services, giving an attacker a way into your own. Password managers don't have that problem.