News for hackers. Stuff that matters.
Re:Using HTTP Basic Auth in 2022 by ncann on Saturday January 01, 2022 @03:38PM (#29762474)
How do you do client side hashing without the server sending the salt/pepper to the client, which is a really bad thing?
Re:Using HTTP Basic Auth in 2022 by notfed on Saturday January 01, 2022 @05:19PM (#29763453)
There are answers to this. I asked myself this a few years ago, which led recursively to new tricky questions. I eventually solved the tree of the questions: I designed myself into a solution that I later realized was essentially an asymmetric PAKE (e.g., analogous to OPAQUE).

So, an attempt to solve your question eventually leads to using an asymetric PAKE. But, this is way, way more complex. You'd really have to squint your eyes to believe that the diminishing returns are worth it.