We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team:
Group 1 wants to adopt an approach that is more concerned about data leakage than MITM attacks:
- Passwords will be sent in the clear in requests (but a MITM would therefore be able to recover a user's password).
- Passwords will be obfuscated in a non-reversible way in the DB (bcrypt).
Group 2 feels that the risk of a MITM attack outweighs that of data leakage. Therefore:
- Passwords will be sent in requests in digest form, so they cannot be recovered by a MITM.
- As a result of using digests, the original password needs to be recoverable on the server so the digest can be recreated. Therefore passwords will be stored encrypted in the database.
While total security is obviously impossible, is there a third way that can have the best of both worlds? While Group 1's approach seems pretty orthodox, how common is Group 2's?