4 ms·
Not if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't diffic
by dspillett 1y ago
Not if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't difficult to skip if you are inclined to make a smidgin of effort.
- thih9 1y agoIt can be done server side too, the old password can be sent along the new one and the server can verify it.
- dspillett 1y agoYes, what I meant to say that it doesn't even have to be done server-side, so the fact it happens doesn't imply the server ever sees the old password beyond it's initial setting.