5 ms·

> Also, fixed length hashes aren't strings. In HTTP everything is a string. > Using a proper cryptography library also might have saved them from using MD5.

• benchaney 9y ago
  > In HTTP everything is a string. Once you parse it out of HTTP it is no longer as string (or at least it should no longer be a string). >HTTP, again. Browser sends MD5 whether you like it or not. They are quite clearly doing verification themselves. They can use whatever algorithm they want.
  • qb45 9y ago
    It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.
    • coldtea 9y ago
      Very easy way around it: do NOT use digest auth.
      • qb45 9y ago
        Sure, which brings us to the second point: HTTP's MD5 digest auth is still good enough to keep passive eavesdroppers from learning the password when TLS isn't used, which is its only purpose.