News for hackers. Stuff that matters.

A comment on WeChat permanently closes account after user sets offensive password. Parent comment

Re:WeChat permanently closes account after user sets offensi... by fhars on Friday June 05, 2020 @01:26PM (#23431153)
Yeah, but then the server must know the plaintext password to check the client reply, which is exactly the problem password hashing schemes were designed to solve.
[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by lordlimecat on Friday June 05, 2020 @03:30PM (#23432814)
That issue is solved by simply having "hash(password+salt)" the thing the server has stored and is checking.

In other words you can combine salts + hashes + nonces to both eliminate the server's need to know the password and the possibility of a replay attack.

[ Parent | on HN ]