31 reputation
3
bio website codeawhile.com
location
age
visits member for 2 years
seen Jul 2 '12 at 16:08

Microsoft Developer by day, Freelance Developer by night.


Jun
27
awarded  Supporter
Jun
27
comment How can I validate a hashed password if all I have is another hash?
This solution solves the original stated problem "This is an effective means of sending sensitive data across the wire (if the logs were read, no one would be able to snag the password). But it breaks another one of my personal security rules - I have access to the user's original password!" If "transmitting credentials over the wire" is the problem, why not use SSL?
Jun
27
comment How can I validate a hashed password if all I have is another hash?
I think maybe we're reading this question a bit differently - I understood the question as "I don't want to have access to the user's plaintext password" (since, presumably that could be used for other services). If the problem is with logging the credentials for accessing this particular service, that is a different problem (and one my solution doesn't solve). I was under the assumption that once you have access to server logs, you already have access to whatever data is available on the server - you just don't want to give up access to services controlled by the same password.
Jun
27
awarded  Editor
Jun
27
revised How can I validate a hashed password if all I have is another hash?
Pointed out there's nothing specific to sha2 for this solution.
Jun
27
awarded  Teacher
Jun
27
answered How can I validate a hashed password if all I have is another hash?