4 ms·
If you send a hash, the hash itself effectively becomes the password. If the server is compromised or the hash is intercepted, the attacker has everything they
by hnaccount141 5y ago
If you send a hash, the hash itself effectively becomes the password. If the server is compromised or the hash is intercepted, the attacker has everything they need to authenticate as you.
With private/public key pairs, the same scenario would result in the attacker only obtaining your public key, which is useless without the private key.
- valenterry 5y agoYou are correct and I was sloppy in explaining it properly. In general however, I believe that there is no inherit advantage of certificates over passwords, except for the key-size obviously. Everything else is just convention/standards. Please see the following page that explains better what I meant when I said that the password should be hashed: https://en.wikipedia.org/wiki/Hash_chain https://en.wikipedia.org/wiki/Hash_chain Using such a mechanism (including salts / challenges) will prevent an attacker using the hash as the password.