New Standard for Sending Password During Authentication
March 17, 2023•101 words
Web services used to store naked passwords in database. Almost all by now have already adopted the salted-hash as presentation of a password in database, ie. Password --HTTP--> Hash --> Compare with the hash in db
The passwords by the above scheme are not stored in database but still known by server-side code. Better flow will be as below, if not E2EE which has different mechanism of authentication with keys.
Password --> Hash --HTTP--> Hash of Hash --> Compare with the hash in db
That is the password, but for full privacy and protection of users' data, E2EE should be used.