News for hackers. Stuff that matters.
Re:Twitter urges users to change passwords after computer 'g... by yuranlu on Thursday May 03, 2018 @11:01PM (#16991912)
The problem with this scheme is that if database storing the salted hashed passwords is compromised, then an attacker can easily log in as any user. In a more standard setup, the attacker needs to send a valid password to log in, which is hard to reverse from the salted hashed password stored server-side. In this scheme, the attacker no longer needs to know the password, as they can just make a client that sends the compromised server hash salted with the random salt requested by the server.
Re:Twitter urges users to change passwords after computer 'g... by jaccarmac on Friday May 04, 2018 @01:32AM (#16992410)
Very true, I had not considered that possibility.