4 ms·
The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a
by andrewaylett 13y ago
The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a dump of a site's database, you can use the stored credential data to authenticate to that site, which isn't possible when you store hashed passwords.
This is better than transmitting passwords in the clear, but worse than transmitting them over an encrypted link.
- colanderman 13y agoYour point is correct but AFAIK your facts are incorrect. Digest authentication can indeed store the password in hashed form. The problem is the the client doesn't need the plaintext password; this hashed form suffices. See <http://en.wikipedia.org/wiki/Digest_access_authentication#Advantages> http://en.wikipedia.org/wiki/Digest_access_authentication#Ad....
- andrewaylett 13y agoThat's what I meant by 'a usable representation thereof' -- sufficient data for a client to be able to use it to authenticate.
- colanderman 13y agoYa that wasn't very clear. Thanks for the downvote.
- andrewaylett 13y agoAs far as I can tell, it's not possible for someone to down-vote a response to a comment they've made -- certainly I'm not able to.