7 ms·
>It depends on what you want to do, if it's user login over HTTPS you can pass a plaintext password to the server and hash/compare on the server only. It would
by kikimora 2y ago
>It depends on what you want to do, if it's user login over HTTPS you can pass a plaintext password to the server and hash/compare on the server only. It would still be secure because the plaintext is never saved in a db (only the hash is), and was TLS encrypted in transport.
:) if I get a penny every time someone logs sensitive information in plain text to some log file without realizing they did.
- bschmidt1 2y agoIf I had a penny for every straw man argument. Who said anything about writing plaintext passwords to files - you just made that up? Also you might not understand web dev 101. Every website including this one that uses HTTPS sends encrypted data, the password you enter in a text input is in plaintext. For the backend - as I said above, the server hashes it and saves the hash, never the plaintext password. That's how it works - nobody said anything about "log files".