5 ms·
The client, or server, could just concatenate all the chars and then calculate whatever hash you desire of the result. Or? Yes, if the machine is compromised t
by tjoff 14y ago
The client, or server, could just concatenate all the chars and then calculate whatever hash you desire of the result. Or?
Yes, if the machine is compromised the attacker could do it as well but the point was to prevent keyloggers specifically.
- godfreykfc 14y agoIf I understand correctly, you are only asked to fill in a few of the 8 characters. (I have seen this before.) You are presented with * * [ ] * [ ] * * [ ] and you are supposed to submit * * [3] * [5] * * [8] so neither side would have enough information to reconstruct the full password based on the user's input alone.