3 ms·
This is trivially solvable by salted hashing twice, once client side (which then can get saved post hash) and once server side.
by nightcracker 7y ago
This is trivially solvable by salted hashing twice, once client side (which then can get saved post hash) and once server side.
- marcinzm 7y agoThat doesn't help you since you authenticate using the client hash so knowing that lets you authenticate remotely anyway. It only protects you against a password that was reused for something else as well.
- nightcracker 7y ago> It only protects you against a password that was reused for something else as well. That was the thing I was protecting against... Of course, no matter what form the access token takes when you press "Keep me logged in" allows you to authenticate remotely.