3 ms·

The request can be logged on server side. Twitter thus logged passwords in plain text some time ago.

• jagged-chisel 4y ago
  There’s nothing that can be done on the client to prevent this. Either your plaintext password can be used directly to login to a system, or your seasoned (on the client) password is effectively the same. Either of these logged can then be used to impersonate you.
  • GoblinSlayer 4y ago
    It prevents leak of plaintext passwords. I suppose impersonation by a twitter employee is not a concern, because they already have access to the twitter system from inside.
  • a1369209993 4y ago
    Yes there is. Use a PBKDF to turn the password into a (public key,signature of session cookie or challenge nonce) pair, and send that to the server. The server stores the public key in place of a salted password and validates the signature in place of password comparison. The 'seasoned' key-signature pair is useless for any later session.