3 ms·
The reason passwords are hashed is to prevent them from being usable to people who gain access to the backend database. If the hash in the backend is the only
by 0x0 6y ago
The reason passwords are hashed is to prevent them from being usable to people who gain access to the backend database.
If the hash in the backend is the only thing you need to calculate the salt challenge, then it is the equivalent of a plaintext password. Someone with access to dumps of a compromised backend database can use the hash directly.
- jakear 6y agoI think we’re making different assumptions about how the challenge/response would be implemented. I agree that if there’s a shared secret and the nonce is simply appended to it and hashed, it’s a poor design.