4 ms·
if you hash locally isn't that effectively like using private/public keys but less secure? might as well use the real thing then.
by em-bee 7mo ago
if you hash locally isn't that effectively like using private/public keys but less secure? might as well use the real thing then.
- dietr1ch 7mo agoThere's no effectively using private/public keys whatsoever. The communication with the server must be secure, the extra hash only provides the ability for the server's data getting leaked without compromising the password through server logs. The usual setup I'd say is to salt the password in the server and store (salt, hash(pw+salt)), but that still handles text-plain password that might get logged by mistake.
- em-bee 7mo agoi meant in term of complexity, if i hash the key on the client, but don't want the hash to become the password then i have to do some dance with sharing a secret or something that is as or more complex than using private/public keys outright.