3 ms·
There is one tiny issue with this approach. Your method forces storage of the password cleartext on the server which is strongly discouraged. You should always
by jzs 15y ago
There is one tiny issue with this approach.
Your method forces storage of the password cleartext on the server which is strongly discouraged.
You should always store the password on the server as a hash of some kind to protect your users against breaches on your side.
- est 15y ago> Your method forces storage of the password cleartext on the server which is strongly discouraged. Actually, no. There is no removing or replacing of characters. You can restore password back on server. Then hash, match against hashed password.
- jzs 15y agoYea i just thought about it. As long as you re-arrange before comparing to the hash. My mistake.