3 ms·
I "invented" javascript-based challenge-response authentication so that the user's password didn't have to go over the wire. I later found out that Yahoo and a
by forgotmypw17 6y ago
I "invented" javascript-based challenge-response authentication so that the user's password didn't have to go over the wire. I later found out that Yahoo and a few others were doing the same thing.
- ReactiveJelly 6y agoIs that widespread now? I mostly stay out of web dev and this is the first I'm hearing of it
- pxx 6y agoThis is mostly a hack back when SSL/TLS wasn't widespread. It doesn't work against an adversary that can intercept and change your packets ("Mallory"). If properly implemented, it can work against an adversary that can only observe them ("Eve"), but I've seen implementations that just hash your password before sending it on the wire. In that case, you just have the same problem as before, but the hashed version of your password is your "real" password.
- forgotmypw17 6y agohttps was also way slower than plain http