3 ms·
There’s nothing that can be done on the client to prevent this. Either your plaintext password can be used directly to login to a system, or your seasoned (on t
by jagged-chisel 4y ago
There’s nothing that can be done on the client to prevent this. Either your plaintext password can be used directly to login to a system, or your seasoned (on the client) password is effectively the same. Either of these logged can then be used to impersonate you.
- GoblinSlayer 4y agoIt prevents leak of plaintext passwords. I suppose impersonation by a twitter employee is not a concern, because they already have access to the twitter system from inside.
- a1369209993 4y agoYes there is. Use a PBKDF to turn the password into a (public key,signature of session cookie or challenge nonce) pair, and send that to the server. The server stores the public key in place of a salted password and validates the signature in place of password comparison. The 'seasoned' key-signature pair is useless for any later session.