2 ms·
> No it doesn't, because all of those attackers have access to the client side salt which is sent to the client in the clear. Why would you send it in the clea
by ebg13 6y ago
> No it doesn't, because all of those attackers have access to the client side salt which is sent to the client in the clear.
Why would you send it in the clear?
- jedberg 6y agoIn the same "clear" that the unhashed password would be sent. ie. I'm assuming they've already compromised your https connection, otherwise it's a moot point.