Storing passwords

Posted Oct 12, 2011 9:43 UTC (Wed) by bjartur (guest, #67801)
In reply to: Storing passwords by mordae
Parent article: WineHQ database compromised

You're essentially describing HTTP Digest authentication w/o the randomized client nonce.
That has actually been implemented in most major HTTP clients. Does lwn support it?

Storing passwords

Posted Oct 12, 2011 12:08 UTC (Wed) by mordae (guest, #54701) [Link]

Ah, there is also the "registration password is hashed in the same way" part missing in my post. Once we've sent password to the server unencrypted, it's not sane to assume it have been stored securely even if we authenticate through digests.

Storing passwords

Posted Oct 12, 2011 20:18 UTC (Wed) by HenrikH (subscriber, #31152) [Link] (1 responses)

If I'm not mistaken HTTP digest requires the site to store the passwords as plain text since it has to perform calculations with it, so I hope that lwn doesn't support it :)

Storing passwords

Posted Oct 13, 2011 15:59 UTC (Thu) by beect (guest, #71486) [Link]

Sites using HTTP Digest can store MD5(username : realm : password). Not much protection, but better than plaintext.