3 ms·
How else would the server know what to check your response against? If you don't want to give the server a password, try SRP.
by jimktrains2 14y ago
How else would the server know what to check your response against? If you don't want to give the server a password, try SRP.
- tptacek 14y ago... but please don't use SRP for your API authentication.
- dllthomas 14y agoWell, in this case (having gone back and actually checked the docs rather than relying on recollection roughly a decade old) you could store MD5(username:realm:password) rather than password, though that doesn't buy you all that much in a case like this where making the password a long, random string that's not reused is not only good practice but also easy and so likely to be general practice.
- tptacek 14y agoStipulating all the other points you've made, exactly what is the purpose of hiding from a server a long random string generated by that server and useful only to that server?
- dllthomas 14y agoYeah, I got there, just was confused about the digest thing.
- jimktrains2 14y agoPreventing someone else from getting that and using it on the server, especially if the service can rack up charges.
- dllthomas 14y agoIf you have the hash, you can log into the site (just not using the typical libraries), so it really doesn't add a lot of security. That's why I was wrong :-P