News for hackers. Stuff that matters.

A comment on Hack of Cupid Media dating website exposes 42 million plaintext passwords. Parent comment

Re:Hack of Cupid Media dating website exposes 42 million pla... by andrewaylett on Wednesday November 20, 2013 @05:47AM (#6767301)
The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a dump of a site's database, you can use the stored credential data to authenticate to that site, which isn't possible when you store hashed passwords.

This is better than transmitting passwords in the clear, but worse than transmitting them over an encrypted link.

[ Parent | on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla... by colanderman on Wednesday November 20, 2013 @08:51AM (#6767918)
Your point is correct but AFAIK your facts are incorrect.

Digest authentication can indeed store the password in hashed form. The problem is the the client doesn't need the plaintext password; this hashed form suffices.

See <http://en.wikipedia.org/wiki/Digest_access_authentication#Ad....

[ Parent | on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla... by andrewaylett on Wednesday November 20, 2013 @08:57AM (#6767953)
That's what I meant by 'a usable representation thereof' -- sufficient data for a client to be able to use it to authenticate.
[ Parent | on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla... by colanderman on Wednesday November 20, 2013 @02:07PM (#6770296)
Ya that wasn't very clear. Thanks for the downvote.
[ Parent | on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla... by andrewaylett on Thursday November 28, 2013 @01:28PM (#6815788)
As far as I can tell, it's not possible for someone to down-vote a response to a comment they've made -- certainly I'm not able to.
[ Parent | on HN ]