4 ms·
Most websites are data sinks of anything that can be taken. No reason IMHO the login page should not always send a hash over ssl. (which is hashed again to test
by teknopaul 5y ago
Most websites are data sinks of anything that can be taken. No reason IMHO the login page should not always send a hash over ssl. (which is hashed again to test it)
- jimktrains2 5y agoI'm not sure what you mean by hash, but i6 think you're trying to describe mutual authentication, where the service also authenticates itself to the user. Look up things like pake, srp, and tls client certificates for more information. https://en.m.wikipedia.org/wiki/Mutual_authentication https://en.m.wikipedia.org/wiki/Mutual_authentication https://en.m.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto... https://en.m.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.m.wikipedia.org/wiki/Password-authenticated_key_a... https://en.m.wikipedia.org/wiki/Client_certificate https://en.m.wikipedia.org/wiki/Client_certificate