3 ms·
I don't think the comment you replied to was referring to checking a "current" password. It's about checking a "new" password when an account is created, or th
by stephenr 7y ago
I don't think the comment you replied to was referring to checking a "current" password.
It's about checking a "new" password when an account is created, or the password changed.
Having said that - I don't see any issue with checking current passwords when the user logs in - you don't send the password to the remote service, so it can't leak that way.
- tomglynch 7y agoYeah I know - checking a new password is worse! Turns out he's downloaded a hashed list and is checking against that. Which is fine.
- stephenr 7y agoThe “regular” api works on a hash of the first handful of characters - in no scenario do you send the actual password to a remote service, so what is your concern?