| ▲ | aeonik an hour ago | |
The point of a hash is that the password is not stored on the machine long term. Thus, if an attacker gains access to the back-end and exports all the hashes, you can't reuse the hashes themselves to login. I.e. you need to do a password-cracking attack, which is infeasible with a password of sufficient length. I don't care if someone gets my password hash. They aren't going to crack it due to the complexity of it. Here is my hashed password. Good luck:
You can't use that to login to my system. You can only use it to validate if I give you my password... | ||