3 ms·
Off the top of my mind. Maybe it could be something like that: 1. Api gives user a fixed salt. 2. User types password into input. 3. Client hashes and sends
by mewpmewp2 6y ago
Off the top of my mind. Maybe it could be something like that:
1. Api gives user a fixed salt.
2. User types password into input.
3. Client hashes and sends hash to server.
4. Server has another salt and uses the client sent hash to hash it again.
5. This final hash is compared what is in the database.
This way server never has knowledge of the original PW and it's never sent over the network. This reduces for instance the chance of password getting logged in the service etc.
- helsinkiandrew 6y agoBut in that case the hash sent to the server in stage 3 is always the same and behaves like a password - capture it and you can use it again elsewhere.