3 ms·

> Not just phishing, server side attacks can hoover up passwords all day long. Just to note that there are password-based login systems that solve this problem

> Not just phishing, server side attacks can hoover up passwords all day long. Just to note that there are password-based login systems that solve this problem: * https://en.wikipedia.org/wiki/Salted_Challenge_Response_Authentication_Mechanism https://en.wikipedia.org/wiki/Salted_Challenge_Response_Auth... * https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

e12e 4y ago
Doesn't solve keyloggers?
px43 4y ago
The attacker controls the login form. They could use javascript to just scrape it out of the password field if they wanted to. Those solutions might get in the way of existing tools for logging password forms, but there are trivial workarounds.