2 ms·
You should check out SCRAM. It solves this problem without sending the hash or the plain text.
by jeltz 8y ago
You should check out SCRAM. It solves this problem without sending the hash or the plain text.
- crazygringo 8y agoFascinating. Yes that does solve the problem, and most importantly doesn't send the hash (unlike what the commenter I was responding to was suggesting, which continues to horrify me). Most interestingly, it solves the problem where the server may not be trusted. I see how this would have protected against the Facebook problem. I'm curious, have any major websites you're aware of adopted SCRAM as a best security practice? It feels kind of like overkill, since generally the server is considered to be trusted... but at the same time, it would definitely prevent accidental logging.
- jeltz 8y agoI have not heard of any website using SCRAM, but recent versions of PostgreSQL use it for password authentication.