3 ms·

It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No wa

by qb45 9y ago

It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.

coldtea 9y ago
Very easy way around it: do NOT use digest auth.
- qb45 9y ago
  Sure, which brings us to the second point: HTTP's MD5 digest auth is still good enough to keep passive eavesdroppers from learning the password when TLS isn't used, which is its only purpose.