News for hackers. Stuff that matters.

A comment on The Correct Way to Validate Email Addresses. Parent comment

Re:The Correct Way to Validate Email Addresses by warfangle on Thursday September 08, 2016 @06:13AM (#12451678)
Isn't that what SSL does? And if the SSL between you and the destination is compromised, you don't even know if the hashing algorithm you asked the client to use is actually the one they used.
[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by Bartweiss on Thursday September 08, 2016 @10:14AM (#12453172)
Yep. And importantly, SSL is securing more than just the password - if you just salt + hash client side, then anyone watching gets to do a replay on that value instead of the original.
[ Parent | on HN ]