Re:Using HTTP Basic Auth in 2022
by hnick on Saturday January 01, 2022 @07:40PM
(#29764499)
Then you either have:
1) A different salt each time, meaning the server must know your plaintext password to validate, or
2) The same salt every time, in which case the hash is essentially the password since that's all the attacker has to pass to the server next time.
1) A different salt each time, meaning the server must know your plaintext password to validate, or 2) The same salt every time, in which case the hash is essentially the password since that's all the attacker has to pass to the server next time.