4 ms·

Realistically we need HTTP digest authentication [0] to use a better hash function then md5, and we need it to be deployed by websites. [0] http://en.wikipedia

Realistically we need HTTP digest authentication [0] to use a better hash function then md5, and we need it to be deployed by websites. [0] http://en.wikipedia.org/wiki/Digest_access_authentication http://en.wikipedia.org/wiki/Digest_access_authentication

andrewaylett 13y ago
The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a dump of a site's database, you can use the stored credential data to authenticate to that site, which isn't possible when you store hashed passwords. This is better than transmitting passwords in the clear, but worse than transmitting them over an encrypted link.
- colanderman 13y ago
  Your point is correct but AFAIK your facts are incorrect. Digest authentication can indeed store the password in hashed form. The problem is the the client doesn't need the plaintext password; this hashed form suffices. See <http://en.wikipedia.org/wiki/Digest_access_authentication#Advantages> http://en.wikipedia.org/wiki/Digest_access_authentication#Ad....
  - andrewaylett 13y ago
    That's what I meant by 'a usable representation thereof' -- sufficient data for a client to be able to use it to authenticate.
    - colanderman 13y ago
      Ya that wasn't very clear. Thanks for the downvote.
      - andrewaylett 13y ago
        As far as I can tell, it's not possible for someone to down-vote a response to a comment they've made -- certainly I'm not able to.
nly 13y ago
Kinda. The important thing to note is that back in 1997, when the digest auth RFC was written, we recognised the hashing before going over the wire... and somehow we lost sight of that
- acdha 13y ago
  The browser implementers completely punted on making HTTP authentication usable: there's no friendly way for a user to logout, for the server to force a logout, for the user to change a password, etc. All of these were well known and discussed from day one but they weren't seen a priority by any vendor and most web developers went with usability over security.
MichaelGG 13y ago
Additionally, you'd need new browser APIs (AFAIK) to detect failed logins, render the login UI, etc. Otherwise, it's going to look out of place and confusing. Product managers are unlikely to accept the default browser/OS handling. And digest auth means a DB dump has enough information to authenticate as a client, which is considerably worse for security if a server gets compromised.
revelation 13y ago
Realistically the problem with that isn't even MD5, it's the modal popup that hasn't changed in any browser since 1999. It's so unbelievably popular, Chrome copied the behavior despite not existing in 1999. It's all over mobile, too...
- nitrogen 13y ago
  I wonder if the original reason for using a modal OS-level popup was to prove that it's not a fake prompt displayed by a malicious site.

andrewaylett 13y ago

The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a dump of a site's database, you can use the stored credential data to authenticate to that site, which isn't possible when you store hashed passwords. This is better than transmitting passwords in the clear, but worse than transmitting them over an encrypted link.

colanderman 13y ago
Your point is correct but AFAIK your facts are incorrect. Digest authentication can indeed store the password in hashed form. The problem is the the client doesn't need the plaintext password; this hashed form suffices. See <http://en.wikipedia.org/wiki/Digest_access_authentication#Advantages> http://en.wikipedia.org/wiki/Digest_access_authentication#Ad....
- andrewaylett 13y ago
  That's what I meant by 'a usable representation thereof' -- sufficient data for a client to be able to use it to authenticate.
  - colanderman 13y ago
    Ya that wasn't very clear. Thanks for the downvote.
    - andrewaylett 13y ago
      As far as I can tell, it's not possible for someone to down-vote a response to a comment they've made -- certainly I'm not able to.

nly 13y ago

Kinda. The important thing to note is that back in 1997, when the digest auth RFC was written, we recognised the hashing before going over the wire... and somehow we lost sight of that

acdha 13y ago
The browser implementers completely punted on making HTTP authentication usable: there's no friendly way for a user to logout, for the server to force a logout, for the user to change a password, etc. All of these were well known and discussed from day one but they weren't seen a priority by any vendor and most web developers went with usability over security.

MichaelGG 13y ago

Additionally, you'd need new browser APIs (AFAIK) to detect failed logins, render the login UI, etc. Otherwise, it's going to look out of place and confusing. Product managers are unlikely to accept the default browser/OS handling. And digest auth means a DB dump has enough information to authenticate as a client, which is considerably worse for security if a server gets compromised.

revelation 13y ago

Realistically the problem with that isn't even MD5, it's the modal popup that hasn't changed in any browser since 1999. It's so unbelievably popular, Chrome copied the behavior despite not existing in 1999. It's all over mobile, too...

nitrogen 13y ago
I wonder if the original reason for using a modal OS-level popup was to prove that it's not a fake prompt displayed by a malicious site.