3 ms·

This doesn't send credentials in plain text.

• jimktrains2 11y ago
  What is being sent to the server then? And by plain-text, I mean the server receives information that could then be used to authenticate later. For instance, if you send the sha of a password, and then store the sha of the sha, you're still sending the password in plaintext, it's just that it's not the password the user entered.
  • TheLoneWolfling 11y ago
    ...Which is why I said "over a secure connection". This method is no less secure than the standard "client sends server password over HTTPS" scheme.
    • josai 11y ago
      > ...Which is why I said "over a secure connection". ... and how do you set up a secure connection without a pre-existing password? Your solution has a chicken-and-egg problem.
      • TheLoneWolfling 11y ago
        HTTPS, the same way everything else solves this problem.
        • jimktrains2 11y ago
          HTTPS doesn't solve the problem of not having to send the plaintext password to the server. SRP does. [0] http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
      • jimktrains2 11y ago
        SRP (e.g. TLS-SRP) doesn't require the server to have the plaintext password. [0] http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
        • josai 11y ago
          The guy I was replying to was arguing against SRP and proposing his own ad-hoc solution.
    • jimktrains2 11y ago
      The connection doesn't matter, you're still sending the plain-text password to the server. The server still has the password.