Notifying administrators about unhashed password storage

Re:Notifying administrators about unhashed password storage by dbt00 on Tuesday May 21, 2019 @10:12PM (#19977125)

If the salt is static, the hash becomes the password. Nobody does this.

If the hash is dynamic, the password has to be stored in plaintext. Kerberos does something like this.

Neither of these are better than the current state of the art. Read up on SRP for a public-key based system that does something like what you want.

Third party data access should go through OAuth, not by sharing passwords to services.

[ Parent | on HN ]

Re:Notifying administrators about unhashed password storage by megous on Wednesday May 22, 2019 @02:04PM (#19983756)

People share passwords, and use e-mail address to create accounts on all kinds of websites.

Anything that would prevent the website's server from getting the plaintext password would be good. Salted hash is obviously not a plaintext password and can't be stuffed around to other services.

[ Parent | on HN ]