4 ms·
Digest mode has the issue that you need the plaintext password on the server side in order to do the authentication.
by asharp 16y ago
Digest mode has the issue that you need the plaintext password on the server side in order to do the authentication.
- btilly 16y agoYou clearly didn't read the link I directed you at. If you had you'd have seen that you only need MD5(username:realm:password), and would have been pointed at JBoss's DIGESTAuth implementation as an example of an implementation that does this.
- asharp 16y ago"You clearly didn't read the link I directed you at." I do believe your tone is rather counterproductive to the purpose of this forum. I did in fact read the article, and I do now agree that you only need to send MD5(username:realm:password) to the remote server to do the authentication. The problem that I do see is that it is trivial for a MITM to either intercept the transaction and force the client into a less secure mode (ie. basic auth), and then read in the password, or else just reuse the auth credentials for another transaction. I would recommend that you look at http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol and the concept of a "zero knowledge password proof" which seems to be the concept you were looking for.