|
Posted by Bruno Barros on 10/01/07 09:39
> The server could send the client an arbitrary word that the client
> should hash, using the password as salt. This salted hash is then sent
> to the server for verification.
If it's arbitrary, then odds are it will not be repeated easily.
What I mean is how does the browser know the salt he gave the user on
registration? I can register and only log the day after. The thingy
will not be in session any longer.
Navigation:
[Reply to this message]
|