logoalt Hacker News

swiftcoderyesterday at 1:18 PM1 replyview on HN

> No, the defining characteristic of a password is also how it is used: it is communicated in the clear to the verifier

This is only true if the verifier lives on your local terminal - otherwise we use an encrypted channel to transmit to the verifier, or do the exactly same type of timed-salted-hash scheme used here to transmit without revealing the password.


Replies

ulrikrasmussenyesterday at 1:58 PM

The thing is that you are sometimes tricked into giving the password to someone who is posing as the verifier.