Hacker News Reader

Comment by dzhiurgis | Hacker News Reader

Why don't browsers send password hashes instead of actual passwords?

This way password manager wouldn't have to store them in cleartext either. Would be pain to enter them manually tho...

Now the effective password (the secret shared between client and server to authenticate) is the hash. So you actually do still need to store the cleartext of this secret.

This might be fine, one of the built-in mechanisms of HTTP that we essentially never use works this way (Digest authentication) but it's far too late to agree it now (every client would need to agree to do this or else you need a complicated fallback plan) and it doesn't do much for you security-wise.

You could use an asymmetric PAKE and that gets you a few more benefits but again every client has to implement this so the back compatibility story is horrible.

Secure Remote Password (SRP) is a protocol for verifying a password without knowledge of the actual password. Now we only need all browsers and applications to support it! Well and a way for initial setup (sharing the seeds).

This has been thought about. Digest auth is a thing, but is stuck on MD5. However, with how flexible a web-form is there really is no way to enforce it so idea never really went that far.

Then stilling the hash is enough to login.

So? If someone can steal the hash, they could probably hijack the session anyway.

Digest auth is a thing, although the user-agent needs the cleartext password for that

If browsers started doing that now, passwords that used to work would stop working.

Reply on news.ycombinator.com