1
$\begingroup$

Suppose a server uses TLS to protect communication between us and the server.
I observe that in the TLS handshake protocol, password is not mentioned anywhere.
Then why do we need to have a password? What is its purpose?

$\endgroup$
3
$\begingroup$

So that the server knows who you are.

After all, TLS protects the communication; however anyone can initiate a TLS connection to the server (unless the server insists that client authentication must be used; they rarely do).

So, if the server needs to make any decision based on who the client is, it needs to find that out itself; TLS usually won't provide client credentials.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.