3 ms·
Yeah, but then the server must know the plaintext password to check the client reply, which is exactly the problem password hashing schemes were designed to sol
by fhars 6y ago
Yeah, but then the server must know the plaintext password to check the client reply, which is exactly the problem password hashing schemes were designed to solve.
- lordlimecat 6y agoThat issue is solved by simply having "hash(password+salt)" the thing the server has stored and is checking. In other words you can combine salts + hashes + nonces to both eliminate the server's need to know the password and the possibility of a replay attack.