Turn of millennium was era before of SSL/TLS. Livejournal did not want to send clear text password during login to the site. SRP was patent encumbered (and anyw

Turn of millennium was era before of SSL/TLS. Livejournal did not want to send clear text password during login to the site. SRP was patent encumbered (and anyway implementing proper PAKE in JavaScript of that era was unfeasible). So at Livejournal implemented their own challenge-handshake auth: https://www.livejournal.com/doc/server/ljp.csp.auth.challresp.html https://www.livejournal.com/doc/server/ljp.csp.auth.challres.... Unfortunately it require storing plain-text equivalent of password on the server. Seems to be worked fine through the years, but they used it well past "best before" date. (SRP - http://srp.stanford.edu/ http://srp.stanford.edu/, PAKE - https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr...)