23 ms·

I think the idea is to hash on client _and_ the server. The client 1-way hash (unlike the server's 2-way) is the new "password" now and it's sole purpose is

by devado 6y ago

I think the idea is to hash on client _and_ the server. The client 1-way hash (~~unlike the server's 2-way~~) is the new "password" now and it's sole purpose is so that you don't get to see the raw password on the server.

ht85 6y ago
> server's 2-way Are thinking of encoding / decoding? If so it isn't used for passwords.
- devado 6y ago
  indeed, scratch that. i rewrote that comment a couple of times, and that 2-way part is of course not correct. this would defeat the point of hashing passwords if they were reversible