3 ms·

> In HTTP everything is a string. Once you parse it out of HTTP it is no longer as string (or at least it should no longer be a string). >HTTP, again. Browser

> In HTTP everything is a string. Once you parse it out of HTTP it is no longer as string (or at least it should no longer be a string). >HTTP, again. Browser sends MD5 whether you like it or not. They are quite clearly doing verification themselves. They can use whatever algorithm they want.

qb45 9y ago
It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.
- coldtea 9y ago
  Very easy way around it: do NOT use digest auth.
  - qb45 9y ago
    Sure, which brings us to the second point: HTTP's MD5 digest auth is still good enough to keep passive eavesdroppers from learning the password when TLS isn't used, which is its only purpose.