fileworm

3 ms·

1. 1.▲
   by fileworm 8y ago

   There is such an API. It's called HTTP authentication. No one uses it.
2. 2.▲
   by fileworm 8y ago

   OK, what are the problems you have with password-authenticated key exchange?
3. 3.▲
   by fileworm 8y ago

   Your proposal is equivalent to sending plaintext passwords, because the client-calculated hash can be used like a password.
4. 4.▲
   by fileworm 8y ago

   It's worse than that. In the web app use case, if the browser is sending cleartext passwords to the server, all an attacker has to do is hijack the server IP with BGP, get a DV SSL cert and slurp up all the passwords.