I'm using AWS Amplify (if that makes any difference, I assume the backend APIs control this regardless) and would like to understand if when a user logs in their password is sent in plaintext (albeit within a TLS connection) or if it's hashed - and if so what the hashing algorithm is.
Does anyone know? Thanks.
In my experience (I don't have anything written from AWS to back this up) Amplify sends a USER_AUTH followed by a password challenge similar to SSH. That means the password is not send over the wire, not plaintext and not hashed. The method would be similar to what is explained here: the client proves that it has the password by answering a challenge. A hashing mechanism is used, but the hash used is not a hash of just the password.
