So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the security questions but masks the answers (I put dummy masked answer on the review page). Now they are given the chance to edit their information before creating an account.
So, if the user decides to go back and edit the security questions and answers, I am wondering should I display the answers back from the server to client in plaintext(The client wants the answers to be typed in as plaintext) or should I just blank out all the answers field (but keep the questions selection) and have the user type in all the answers again to proceed?
What is the better approach from a security standpoint?
Currently, I would be hashing and adding a salt to the security answers to be saved as such in the database.