4 ms·
On a related note to MD5 and spam, I remember in the pre-TLS days when Yahoo's login page did the following (over regular http): - login page opened - there w
by alexpotato 3y ago
On a related note to MD5 and spam, I remember in the pre-TLS days when Yahoo's login page did the following (over regular http):
- login page opened
- there was a seed value embedded in the form
- the page also loaded a Javascript implementation of MD5
- use enters their password
- the page hashes the seed and the password
- the POST only sends the hashed value above
Everything is https these days so you don't really see this anymore but I've always liked this piece of internet history.
- TonyTrapp 3y agoThis can still make sense today even with TLS depending on your trust model, because it means that even the server won't see the plaintext password.