Re:Twitter urges users to change passwords after computer 'g...
by yuranlu on Thursday May 03, 2018 @11:01PM
(#16991912)
The problem with this scheme is that if database storing the salted hashed passwords is compromised, then an attacker can easily log in as any user. In a more standard setup, the attacker needs to send a valid password to log in, which is hard to reverse from the salted hashed password stored server-side. In this scheme, the attacker no longer needs to know the password, as they can just make a client that sends the compromised server hash salted with the random salt requested by the server.
[ Parent
| on HN ]