hwaccel
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
on Sunday March 31, 2024 @02:19AM (#39881897)
> Salted hash for transmitting passwords is a good technique. This ensures that the password can not be stolen even if the SSL key is broken
I'm a little confused with this recommendation
How server is supposed to verify user's password in this case? Store the same hash with exactly the same salt in the database, effectively making the transmitted salted hash a cleartext password?