3 ms·
What's the point of the key stretching on the client side, if your stretched key gets sent to the server and is stored in plaintext. It adds no security. Serv
by ye 13y ago
What's the point of the key stretching on the client side, if your stretched key gets sent to the server and is stored in plaintext.
It adds no security.
Server-side salting and hashing is the answer.
- hobs 13y agoI think the use of that is really just isolating the cross site hacking at that point. You are absolutely correct that if they have your password, its game over on that particular site.
- nly 13y agoIt's not a vanilla stretched key that gets send to the server. It is, in effect, the equivalent of your public key (that just happens to be kept secret by the server so it can use it to prove its identity, as the bearer, to you)