10:51 AM
@tylerl The basic idea doesn't sound that dumb.
Of course sending a salted sha2 hashed password to a third party is dumb.
The simplest secure way would be simply downloading the whole blacklist, but of course that'd give it away.
But you could also download an encrypted blacklist and then use a bit of fancy crypto.
That way the client wouldn't learn the contents of the blacklist and the server wouldn't learn the password of the user who logs in.
@tylerl Wow they didn't even get what a salt is:
> The salts utilized are the same amongst all PasswordRBL customers.