There is a secure auth mode for SSL called TLS-SRP, RFC 5054. It is quite clean, deriving a session key and authenticating the session in the same number of rou

There is a secure auth mode for SSL called TLS-SRP, RFC 5054. It is quite clean, deriving a session key and authenticating the session in the same number of round trips as a regular TLS handshake. It is secure against dictionary attacks. http://srp.stanford.edu/whatisit.html http://srp.stanford.edu/whatisit.html http://www.ietf.org/rfc/rfc5054.txt http://www.ietf.org/rfc/rfc5054.txt Now, if only more browsers would support it.