3 ms·
Congratulations, if I'm not mistaken you just defeated the entire purpose of hashing passwords. The point is that the server doesn't store what's used to verif
by buildzr 7y ago
Congratulations, if I'm not mistaken you just defeated the entire purpose of hashing passwords.
The point is that the server doesn't store what's used to verify directly, it needs to provide something that can generate it. The way you're doing it, someone can dump your DB and login as anyone. If you want a secure way to do this maybe look into SRP or similar PAKE protocols.
- tragicpapercut 7y agoThis is why you shouldn't "innovate" with encryption unless you are a trained cryptographer (or equivalent). Cryptographers may be programmers, but programmers are not cryptographers.
- zaarn 7y agoYou don't need to be a cryptographer to know that you don't do plaintext passwords.
- pvorb 7y agoBut it seems it wasn't obvious to bullen that this way the password is essentially sent in plain text. So yes, let your authentication be analyzed by an expert or use standard software.
- kingludite 7y agoto state the obvious: there are other things you don't do