To my knowledge it works like this:
- The server receives the username-password values over a secure & encrypted channel.
- The username-password values are decrypted in the server and are present as plaintext.
- With the username the according salt gets retrieved for the user.
- The salt is appended to the plaintext-password and is finally hashed.
- The hash is compared to the stored hash and depending if the hashes match or not the user gets logged in or receives some sort of a message that says that the username / password is wrong.
Hypothetical problem: If for example we have a vicious programmer "Mallory" that works as a programmer for the company he could write a piece of code inside the authentication process to receive the plaintext password:
private bool Authentication(string username, string password)
{
// Some code ...
log($"{username}, {password}"); // Logs the plaintext username & password for Mallory
// Some more code ...
}
For this example we assume that the company fully trusts Mallory and that nobody else ever checks the source code.
My questions are:
Is it possible to change this authentication mechanism in a way so that the password is never present as plaintext?
Is it possible to prevent this without changing the effort for a user, like introducing two-factor-authentication or something similar?