4 ms·
If all you are comparing is HASH(random_string + hashed_password) then it will still work. The server will give me random_string and I know hashed_password fro
by k1t 6y ago
If all you are comparing is HASH(random_string + hashed_password) then it will still work.
The server will give me random_string and I know hashed_password from the DB leak.
Obviously this assumes the login process actually works as described in the earlier post.
- lostmsu 6y agoThat protects hashes from leaking in transit, for the scenario with 3rd party TLS terminators mentioned above.