2 ms·
Yeah, thats exactly my point. So the MITM who got the PW after client side hash, but before server side salt and hash would have to brute force that hash in ord
by evanreichard 6y ago
Yeah, thats exactly my point. So the MITM who got the PW after client side hash, but before server side salt and hash would have to brute force that hash in order to use it on those other sites. That's the only benefit I see, and a very specific set of circumstances.
- gpm 6y agoIs it incredibly specific? I feel like that happens time and time again when companies accidently "mitm" themselves with logs or whatever.