Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on McGill will double your password if you don’t do it first. Parent comment
Yes, you are wrong.
> we basically have three options
Or sending the plaintext password over the wire using SSL?
You are aware that to use a hash the server needs the plain text password right? And not just them, every server needs this?
You are acting like getting the plaintext password is something strange. It's not.
You can send the password encrypted or not, it has nothing to do with the hash on the server.
> but that still wouldn't allow them to compute the 2x hash
As I have said already, they are not computing the 2x hash.
There are no comments on this comment yet.
Yes, you are wrong.
> we basically have three options
Or sending the plaintext password over the wire using SSL?
You are aware that to use a hash the server needs the plain text password right? And not just them, every server needs this?
You are acting like getting the plaintext password is something strange. It's not.
You can send the password encrypted or not, it has nothing to do with the hash on the server.
> but that still wouldn't allow them to compute the 2x hash
As I have said already, they are not computing the 2x hash.