4 ms·
Do you agree that storing passwords in plain text is a problem? My point is that storing passwords in a way compatible with using Digest authentication is esse
by jamespwilliams 5y ago
Do you agree that storing passwords in plain text is a problem?
My point is that storing passwords in a way compatible with using Digest authentication is essentially equivalent to storing your passwords in plain text, at least with respect to your own site’s authentication.
- bullen 5y agoYou don't store them as plain text, you store them as hashes. And then you send a server salt/nonce and the browser hashes the plain text password with the salted hash in your database and then with the server salt/nonce. Still HTTPS solves nothing of that. I don't even know what Digest is... I'm talking this RFC: https://datatracker.ietf.org/doc/html/rfc2289 https://datatracker.ietf.org/doc/html/rfc2289