3 ms·
Could that really work? Sounds like it's highly abusable if someone compromises the database and gets a list of all the hashes. Now, they don't even need to use
by xmprt 5y ago
Could that really work? Sounds like it's highly abusable if someone compromises the database and gets a list of all the hashes. Now, they don't even need to use rainbow tables or any brute force to compute the password. They just send the hash to the server and will be logged in.
- mikea1 5y agoThe salt-and-hash combo is how email logins worked for decades. The problem with this approach is that what you really want different salts, which requires that the server knows the plain text password.
- armchairhacker 5y agoYes, if an attacker compromises the database they can send the direct hash. The point is that a malicious or badly-secured site can't use your password on other websites, because ultimately most people use the same password on many different sites.