News for hackers. Stuff that matters.

A comment on Steam's login method is kinda interesting. Parent comment

Re:Steam's login method is kinda interesting by k1t on Monday January 11, 2021 @11:59AM (#25731755)
If all you are comparing is HASH(random_string + hashed_password) then it will still work.

The server will give me random_string and I know hashed_password from the DB leak.

Obviously this assumes the login process actually works as described in the earlier post.

[ Parent | on HN ]
Re:Steam's login method is kinda interesting by lostmsu on Monday January 11, 2021 @02:06PM (#25734422)
That protects hashes from leaking in transit, for the scenario with 3rd party TLS terminators mentioned above.
[ Parent | on HN ]