News for hackers. Stuff that matters.

A comment on Hack of Cupid Media dating website exposes 42 million plaintext passwords. Parent comment

Re:Hack of Cupid Media dating website exposes 42 million pla... by nly on Wednesday November 20, 2013 @05:52AM (#6767309)
Kinda. The important thing to note is that back in 1997, when the digest auth RFC was written, we recognised the hashing before going over the wire... and somehow we lost sight of that
[ Parent | on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla... by acdha on Wednesday November 20, 2013 @01:10PM (#6769760)
The browser implementers completely punted on making HTTP authentication usable: there's no friendly way for a user to logout, for the server to force a logout, for the user to change a password, etc. All of these were well known and discussed from day one but they weren't seen a priority by any vendor and most web developers went with usability over security.
[ Parent | on HN ]