101 reputation
1
bio website brendanlong.com
location Colorado
age 25
visits member for 2 years, 2 months
seen Aug 20 at 15:05

Jun
27
comment How can I validate a hashed password if all I have is another hash?
By the way, if you're really paranoid about security, don't use a general purpose hash function (SHA###) for password hashing. Use bcrypt or PBDKF2, which are actually designed for securely hashing passwords.
Jun
27
comment How can I validate a hashed password if all I have is another hash?
@DavidSchwartz It seems to solve the two major problems: (1) the server never sees the plaintext password and (2) stealing the hashed password isn't sufficient to log in. There are probably better solutions but this does solve the problem posed in the question.
Jun
27
awarded  Supporter
Jun
27
comment How can I validate a hashed password if all I have is another hash?
@DavidSchwartz That's not true. The server stores sha2(sha2(client_salt+password)+server_salt), which is not sufficient to log in. To log in, you need the inner part (sha2(client_salt+password)), which cannot be easily found from the stored data (the whole point of password hashing). Your question seems to be implying that sha2 is reversible, which is not (except in trivial cases like dictionary attacks, and no password in a dictionary is ever safe). You could improve it by using bcrypt, but the idea is sound.