3 ms·
Not always. The client could salt and hash the password before sending it to the server for storage and comparison. To be clear: a properly designed system can
by unethical_ban 5y ago
Not always. The client could salt and hash the password before sending it to the server for storage and comparison.
To be clear: a properly designed system can and should operate without the server ever knowing the plaintext password.