34 ms·
This still requires you to hash the hash on the server, otherwise the hash becomes the password and learning the hash allows you to login. But hashing the hash
by zrm 6y ago
This still requires you to hash the hash on the server, otherwise the hash becomes the password and learning the hash allows you to login. But hashing the hash is actually better anyway because it makes it so that the server never even has the plaintext of the password, which can be dangerous in itself when users use the same password on multiple sites.