Re:McGill will double your password if you don’t do it first
by ars on Wednesday November 19, 2014 @01:53AM
(#8628629)
> Correct me if i'm wrong here
Yes, you are wrong.
> we basically have three options
Or sending the plaintext password over the wire using SSL?
You are aware that to use a hash the server needs the plain text password right? And not just them, every server needs this?
You are acting like getting the plaintext password is something strange. It's not.
You can send the password encrypted or not, it has nothing to do with the hash on the server.
> but that still wouldn't allow them to compute the 2x hash
As I have said already, they are not computing the 2x hash.
1) Storing the password in plaintext. 2) Sending the password over the wire in plaintext. 3) Computing two hashes on the same system (presumably) via the same function, with a known relationship between their inputs.
I guess the fourth option is they have a securely stored hash of the password, but that still wouldn't allow them to compute the 2x hash server side so we're looking at another round trip and/or number three above.
Not confidence inspiring.