News for hackers. Stuff that matters.

A comment on Using HTTP Basic Auth in 2022. Parent comment

Re:Using HTTP Basic Auth in 2022 by throw0101a on Saturday January 01, 2022 @03:54PM (#29762654)
> If I was a hacker, I can add JavaScript to send plaintext somewhere. If I was a hacker, I could change the login form to stop hashing them client-side and instead send them over to the server for hashing and inspection.

If a zero knowledge (ZK) system combined with HTTP Basic was used, then account entry would come from the browser itself and not a web form that could be intercepted by JavaScript.

Further, a ZK system would help with the silliness of folks using bad algorithms (straight MD-5 / SHA-1) to store passwords, or even storing them in plain-text.

[ Parent | on HN ]
Re:Using HTTP Basic Auth in 2022 by gjsman-1000 on Saturday January 01, 2022 @04:14PM (#29762885)
Right - it would, I don't disagree, it'd be awesome. It's something like WebAuthn.

I'm arguing here more against some people who think that using a JavaScript-based system to hash the password entry before sending it to the server is a good idea.

[ Parent | on HN ]
Re:Using HTTP Basic Auth in 2022 by masklinn on Saturday January 01, 2022 @04:21PM (#29762958)
> I'm arguing here more against some people who think that using a JavaScript-based system to hash the password entry before sending it to the server is a good idea.

So you're arguing against something nobody is arguing for?

[ Parent | on HN ]
Re:Using HTTP Basic Auth in 2022 by madacol on Saturday January 01, 2022 @05:47PM (#29763682)
So you are strawmanning?
[ Parent | on HN ]