4 ms·
"Digest" authentication was always bad, even back when HTTPS was difficult. It requires the server to store passwords in plaintext, rather than as hashes.
by LukeShu 5y ago
"Digest" authentication was always bad, even back when HTTPS was difficult.
It requires the server to store passwords in plaintext, rather than as hashes.
- duskwuff 5y agoDigest auth stores passwords on the server as plaintext; basic auth transmits passwords over the network as plaintext. Both are bad, but I feel like having the plaintext on the network is probably worse.
- LukeShu 5y agoFor sure. But "better than 'Basic'" is a much lower bar than "not bad". I was going to say that this problem is already noted in the very first RFC, that it was already known to be broken on day one; but on a closer reading I'm not sure that's actually true.
- nmadden 5y agoThe format that Digest uses to transmit passwords is not a lot better than plaintext. It’s a simple salted hash, which is easily brute-forced offline unless the password is strong.