Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl...
by zygentoma on Tuesday April 02, 2024 @07:58AM
(#39904738)
No. Everything you do on the client side you can also keep not doing at all.
You can imagine the salted and hashed password in your scheme to be "the password". Because the server will still know it, and could use it to log in somewhere else (it just has to skip the salt-and-hash step).
You can imagine the salted and hashed password in your scheme to be "the password". Because the server will still know it, and could use it to log in somewhere else (it just has to skip the salt-and-hash step).