4 ms·
Well, it’s sending a sha256 for your phone number, how is this not good enough? How you would expect to check the number in the database without hashing or pass
by hartator 6y ago
Well, it’s sending a sha256 for your phone number, how is this not good enough? How you would expect to check the number in the database without hashing or passing it clear?
- code-express 6y agoThere are better ways, that involve more computation on the client side. For example, HIBP does not send your password (or its complete hash) to the backend in order to find if it has been previously exposed. They use this method: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...