Hacker News Reader

What is being sent to the server then?

And by plain-text, I mean the server receives information that could then be used to authenticate later.

For instance, if you send the sha of a password, and then store the sha of the sha, you're still sending the password in plaintext, it's just that it's not the password the user entered.

View on HN

...Which is why I said "over a secure connection".

This method is no less secure than the standard "client sends server password over HTTPS" scheme.

> ...Which is why I said "over a secure connection".

... and how do you set up a secure connection without a pre-existing password?

Your solution has a chicken-and-egg problem.

HTTPS, the same way everything else solves this problem.

HTTPS doesn't solve the problem of not having to send the plaintext password to the server.

SRP does.

[0] http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

SRP (e.g. TLS-SRP) doesn't require the server to have the plaintext password.

[0] http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

The guy I was replying to was arguing against SRP and proposing his own ad-hoc solution.

The connection doesn't matter, you're still sending the plain-text password to the server. The server still has the password.

Reply on news.ycombinator.com