4 ms·

Sending a hash seems pointless because I assume sites would salt/pepper the password before hashing so the hashes are different. Or maybe I'm naive about sites

by vinyl7 2y ago

Sending a hash seems pointless because I assume sites would salt/pepper the password before hashing so the hashes are different. Or maybe I'm naive about sites following best practices

lupire 2y ago
Google isn't comparing your password to a password inside some other site's server! It's comparing to leaked passwords.
- vinyl7 2y ago
  If sites leaked passwords were hashes of salt/peppered passwords then it wouldn't match