this post was submitted on 18 Jul 2023
10 points (81.2% liked)
Discussions related to Infosec.pub
1208 readers
2 users here now
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The server needs to receive your password to verify it and log you it. That's how it always is. As long as you are connecting via HTTPS, this is not a problem.
Why not hash it client side? Edit: Isn't SSL vulnerable to MITM attacks? (I am a noob in this field)
The first paragraph is correct, but your second paragraph is not. A cryptographic hash function is a lossy one-way function. Knowing exactly how something was hashed does not mean you can turn the hash back into the starting value again.
Oh okay makes sense thanks!
Why would the hash be reversible? SHA256 is public and it's not reversible