3 ms·

I don't understand. So, you type in your password, and this input is sent (securely?) to their server, where it is hashed, and this hash is checked against the

I don't understand. So, you type in your password, and this input is sent (securely?) to their server, where it is hashed, and this hash is checked against their stored hash. But they can also "capture" this password prior to it being hashed? But then Facebook could do a few string manipulation operations, and then securely delete the un-hashed password from memory. Am I understanding this correctly?

MartinCron 14y ago
The password is sent from your browser to the server in a way that the server can read it as cleartext. When you log in over SSL, all that does is protect your password (or whatever) from being interpreted by third parties. Your browser doesn't do any hashing, it doesn't (and shouldn't) know about whatever password hashing scheme is happening on the server. This is how sites can (but shouldn't) store passwords in clear text, because that's how they get them in the first place.