They explain it pretty well, but i'm still struggling to understand this one part...
Now, when a user comes to log in again they submit their username and password in the form. You then want to see if they are in the table so you then:
1) Look up the supplied username in your database and return the hash and the salt
2) Take the provided username and rerun the hashing function using the salt obtained in 1 to do somehting like hash(salt+password submit on form)
3) If the hash generated in 2, matches the on retrieved from the database in 1 then you know they provided the correct password
Does the client side of the application make the stored hash(pw+salt), send it over ssl/tls to the server and then check if it matches the one stroed on server ? if so , how do we get the salt ? Is it okay to send it from server to client in plain text over ssl/tls ?
Or do we send the password from client-side to server in plain text over ssl/tls and then generate the hash(pw+salt) on server-side whereafter we'd check if it matches ?