5 ms·

They could send you a challenge salt that you hash together with your hashed password and send back as a response. So that string is valid only once.

• hunter2_ 6y ago
  "Nonce" is probably the word you're looking for.
• 0x0 6y ago
  Doesn't mitigate the fact that this type of scheme turns the hashed password into the equivalent of THE cleartext password. It's usually compromised/dumped server databases you want to protect against.
  • jakear 6y ago
    No, the outlined scheme is actually correct. If there’s a call/response aspect, then the hashed nonce+password is not “the cleartext password”, it’s “the cleartext password for that particular challenge”, which makes it useless for other auth attempts, which would have different challenges.
    • 0x0 6y ago
      The reason passwords are hashed is to prevent them from being usable to people who gain access to the backend database. If the hash in the backend is the only thing you need to calculate the salt challenge, then it is the equivalent of a plaintext password. Someone with access to dumps of a compromised backend database can use the hash directly.
      • jakear 6y ago
        I think we’re making different assumptions about how the challenge/response would be implemented. I agree that if there’s a shared secret and the nonce is simply appended to it and hashed, it’s a poor design.