3 ms·
Maybe, but it conceptually it doesn't have to be like that. Often, the password is not sent directly, but its hash is sent (sometimes hashed multiple times), so
by valenterry 5y ago
Maybe, but it conceptually it doesn't have to be like that. Often, the password is not sent directly, but its hash is sent (sometimes hashed multiple times), so that the same property is true.
- hnaccount141 5y agoIf you send a hash, the hash itself effectively becomes the password. If the server is compromised or the hash is intercepted, the attacker has everything they need to authenticate as you. With private/public key pairs, the same scenario would result in the attacker only obtaining your public key, which is useless without the private key.
- valenterry 5y agoYou are correct and I was sloppy in explaining it properly. In general however, I believe that there is no inherit advantage of certificates over passwords, except for the key-size obviously. Everything else is just convention/standards. Please see the following page that explains better what I meant when I said that the password should be hashed: https://en.wikipedia.org/wiki/Hash_chain https://en.wikipedia.org/wiki/Hash_chain Using such a mechanism (including salts / challenges) will prevent an attacker using the hash as the password.