Double hashing passwords - client & server
- by J. Stoever
Hey, first, let me say, I'm not asking about things like md5(md5(..., there are already topics about it.
My question is this:
We allow our clients to store their passwords locally. Naturally, we don't want them stored in plan text, so we hmac them locally, before storing and/or sending. Now, this is fine, but if this is all we did, then the…
