network profile
| bio | website | codeawhile.com |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 10 months |
| seen | Jul 2 '12 at 16:08 | |
| stats | profile views | 1 |
Microsoft Developer by day, Freelance Developer by night.
|
Jun 27 |
awarded | Supporter |
|
Jun 27 |
comment |
How can I validate a hashed password if all I have is another hash? This solution solves the original stated problem "This is an effective means of sending sensitive data across the wire (if the logs were read, no one would be able to snag the password). But it breaks another one of my personal security rules - I have access to the user's original password!" If "transmitting credentials over the wire" is the problem, why not use SSL? |
|
Jun 27 |
comment |
How can I validate a hashed password if all I have is another hash? I think maybe we're reading this question a bit differently - I understood the question as "I don't want to have access to the user's plaintext password" (since, presumably that could be used for other services). If the problem is with logging the credentials for accessing this particular service, that is a different problem (and one my solution doesn't solve). I was under the assumption that once you have access to server logs, you already have access to whatever data is available on the server - you just don't want to give up access to services controlled by the same password. |
|
Jun 27 |
awarded | Editor |
|
Jun 27 |
revised |
How can I validate a hashed password if all I have is another hash? Pointed out there's nothing specific to sha2 for this solution. |
|
Jun 27 |
awarded | Teacher |
|
Jun 27 |
answered | How can I validate a hashed password if all I have is another hash? |
