Re: New Input type proposal

Jeff wrote:
> 
>  I think he's talking about the salt. Do you pass the salt with the form

> submit, if you do, what is the security advantage?

A salt is always used to have a hash which is different from the regular 
hash (to prevent precomputed hash tables). In case of salt, it certainly 
always have to be the same.

As to the replay salt, this would only be used to prevent replay attacks 
and would or better should always be differently. Of course it wouldnt 
be used to store the password hash.

> 
>   All this looks a bit like unix password encryption where no one knows 
>  the password, only if it is wrong. What would the application be?

Well, yes, hashes are used in Unix too, but it is a general solution and 
most websites use a hash to store passwords with the exception that the 
server is generating the hash.

Alexander