Re:Using HTTP Basic Auth in 2022
by eyelidlessness on Saturday January 01, 2022 @11:44PM
(#29765902)
> It's essentially impossible to reverse the hashed password.
It’s essentially a nontrivial unit of work to brute force the hash (or exploit collisions for a compromised hashing algo). That’s not impossible but it’s important not to overstate its safety too.
Re:Using HTTP Basic Auth in 2022
by mholt on Sunday January 02, 2022 @04:52AM
(#29767318)
... for one account. It takes N times as many more resources to do that for N more accounts. The attacks are impractically expensive for most attackers.
It’s essentially a nontrivial unit of work to brute force the hash (or exploit collisions for a compromised hashing algo). That’s not impossible but it’s important not to overstate its safety too.