Post #4282093

@iagox86@infosec.exchange @Javvad@infosec.exchange Another thing: We shouldn't be sending passwords over the wire. If your Pokemon forum uses Argon2, but the php script (due to compromise or accident) logs its POST variables to a file, the Argon2 is useless. Protocols like SRP for password login without transmission have existed for decades, but were never deployed, instead we tried replacing passwords entirely with passkeys, an overcomplicated, restrictive solution that (apparently) not everyone is willing to put up with.