Re:Using HTTP Basic Auth in 2022
by xmprt on Saturday January 01, 2022 @05:29PM
(#29763535)
Could that really work? Sounds like it's highly abusable if someone compromises the database and gets a list of all the hashes. Now, they don't even need to use rainbow tables or any brute force to compute the password. They just send the hash to the server and will be logged in.
[ Parent
| on HN ]
Re:Using HTTP Basic Auth in 2022
by armchairhacker on Saturday January 01, 2022 @09:02PM
(#29764996)
Yes, if an attacker compromises the database they can send the direct hash.
The point is that a malicious or badly-secured site can't use your password on other websites, because ultimately most people use the same password on many different sites.
The salt-and-hash combo is how email logins worked for decades. The problem with this approach is that what you really want different salts, which requires that the server knows the plain text password.