4 ms·
This is only a problem in the sense that once one hash has been cracked the so is the other, however most authentication is done using some user/email attribute
by ashconnor 14y ago
This is only a problem in the sense that once one hash has been cracked the so is the other, however most authentication is done using some user/email attribute also.
Usually we fetch user/email, hash password, compare to hash in database - authenticate if match or deny if not.
- lotu 14y agoSo, no changing of email without changing the password then?
- jmaygarden 14y agoNo, just require that the password is entered to change the user's email address. Then a new hash can be generated and stored.