News for hackers. Stuff that matters.

A comment on Programming Zero Knowledge Proofs: From Zero to Hero. Parent comment

Re:Programming Zero Knowledge Proofs: From Zero to Hero by kikimora on Friday September 06, 2024 @04:30AM (#41464142)
>It depends on what you want to do, if it's user login over HTTPS you can pass a plaintext password to the server and hash/compare on the server only. It would still be secure because the plaintext is never saved in a db (only the hash is), and was TLS encrypted in transport.

:) if I get a penny every time someone logs sensitive information in plain text to some log file without realizing they did.

[ Parent | on HN ]
Re:Programming Zero Knowledge Proofs: From Zero to Hero by bschmidt1 on Friday September 06, 2024 @03:32PM (#41469034)
If I had a penny for every straw man argument. Who said anything about writing plaintext passwords to files - you just made that up?

Also you might not understand web dev 101. Every website including this one that uses HTTPS sends encrypted data, the password you enter in a text input is in plaintext. For the backend - as I said above, the server hashes it and saves the hash, never the plaintext password.

That's how it works - nobody said anything about "log files".

[ Parent | on HN ]