Posted by Bruno Barros on 10/01/07 09:39

> The server could send the client an arbitrary word that the client
> should hash, using the password as salt. This salted hash is then sent
> to the server for verification.

If it's arbitrary, then odds are it will not be repeated easily.

What I mean is how does the browser know the salt he gave the user on
registration? I can register and only log the day after. The thingy
will not be in session any longer.

[Back to original message]