4 ms·
The difference is that you're never entrusting the authenticating party with any secret. Even if their entire full-cleartext database leaks, an attacker could n
by sascha_sl 5y ago
The difference is that you're never entrusting the authenticating party with any secret. Even if their entire full-cleartext database leaks, an attacker could not even authenticate against that _same_ site.