New Standard for Sending Password During Authentication

Web services used to store naked passwords in database. Almost all by now have already adopted the salted-hash as presentation of a password in database, ie. Password --HTTP--> Hash --> Compare with the hash in db

The passwords by the above scheme are not stored in database but still known by server-side code. Better flow will be as below, if not E2EE which has different mechanism of authentication with keys.
Password --> Hash --HTTP--> Hash of Hash --> Compare with the hash in db

That is the password, but for full privacy and protection of users' data, E2EE should be used.


You'll only receive email when they publish something new.

More from 19411
All posts