3 ms·
I feel dumb asking this, but does current industry authentication methods (secure channel via TLS) send the actual password, or a derived challenge-response val
by GhettoMaestro 7y ago
I feel dumb asking this, but does current industry authentication methods (secure channel via TLS) send the actual password, or a derived challenge-response value through the secure channel? I thought it was the latter.
- M4v3R 7y agoIn 99% cases client sends the actual password to the server. If you don't want to send the actual password over the wire then you use SRP (or something similar) mentioned in the original post.
- GhettoMaestro 7y agoThanks for clearing that up. I had incorrectly assumed that something other than SRP had come along to fulfill this need - I guess not!