4 ms·
Yes, again if the database is compromised, it's compromised... I don't understand why so many people keep mentioning that when HTTPS does not solve that either?
by bullen 5y ago
Yes, again if the database is compromised, it's compromised... I don't understand why so many people keep mentioning that when HTTPS does not solve that either?!
- thayne 5y agoIf a database of passwords is compromised, but the passwords are properly hashed and salted (server-side, not client-side), then you would need a rainbow table for each salt in order to actually get something usable from the compromised data.
- bullen 5y agoOk, how does HTTPS help with that? And who cares if you need a rainbow table?
- thayne 5y ago> how does HTTPS help with that Ignoring all the other benefits of HTTPS, it means you can securely transfer the password itself to the server, or a deterministic hash of the password which the server hashes again. Not to mention that you can use a stronger hashing algorithm, like bcrypt. There might be other ways to do this, but https is definitely the most practical. > who cares if you need a rainbow table? If the passwords are moderately strong and you are using a good hashing algorithm (that is salted), then creating a big enough rainbow table (or brute forcing) is intractable.