3 ms·
And how exactly would having the hash in the log versus having the password in the log be an improvement? If someone gets that hash it's exactly the same as hav
by peanut-walrus 5y ago
And how exactly would having the hash in the log versus having the password in the log be an improvement? If someone gets that hash it's exactly the same as having the password, as it is the hash that gets sent to your server in the http request.
Edit: alright, I saw that you mentioned password reuse in another reply, fair enough, it does help against that.
- lolc 5y agoProper client-side hashing uses a nonce generated by the server. The transmitted hash is only valid in that session. Even if the nonce and the hashed product are logged, you can't reuse it, because the nonce will be different for your login attempt.