Hacker News Reader

Do you agree that storing passwords in plain text is a problem?

My point is that storing passwords in a way compatible with using Digest authentication is essentially equivalent to storing your passwords in plain text, at least with respect to your own site’s authentication.

View on HN

You don't store them as plain text, you store them as hashes.

And then you send a server salt/nonce and the browser hashes the plain text password with the salted hash in your database and then with the server salt/nonce.

Still HTTPS solves nothing of that.

I don't even know what Digest is... I'm talking this RFC:

https://datatracker.ietf.org/doc/html/rfc2289

Reply on news.ycombinator.com