← Back to context

Comment by aeonik

4 days ago

This would work, but the first stage hash is effectively the password at this point.

    Client:
        C = SHA256(password)
    
    Server:
        V = Argon2id(C, server_salt)
    
    Database:
        stores V and server_salt

1 comment

aeonik

Reply
undersuit  4 days ago

Good I still don't want to know the password. If the first stage hash is compromised there are bigger issues, bigger than even if the database of hashes or passwords got hacked.