I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, certain methods were described which provide resistance to replay attacks, MITM etc.

Some methods described were:-

1) Random Challenge method, where server providing a random string to client, client encrypting it with its key/password (symmetric) and sending the result back to the server. Server doing the similar process (or the reverse) to determine the authenticity of the user.

2) Relying on SSL/TLS for the encyption

3) Certificate based Authentication

My question is - Which of the above method is in current practice? Like when we try to login to our Google, Facebook or Stackexchange account which authentication method is used?

  • 4
    Like when we try to login to our Google, Facebook or Stackexchange -- plain password-based authentication. Just over TLS.
    – Crypt32
    Nov 6, 2019 at 7:52
  • 1
    @Crypt32 meaning password in plaintext (encrypted with TLS) is sent over to the server for authentication?
    – Vasu Deo.S
    Nov 6, 2019 at 8:25
  • Yes, pretty much. And when authenticating between websites, for example, logging into StackExchange via your Google account, oAuth is used.
    – Izy-
    Nov 6, 2019 at 8:58
  • 1
    @Izy- So that means that our Passwords are sent in plaintext (enc. via TLS) and upon reaching the server, the server produces it's hash by adding a salt to the PT. And then stores/compares the password. (I've used stores assuming the user is setting up a new account)
    – Vasu Deo.S
    Nov 8, 2019 at 4:43
  • 1
    The password isn't necessarily always sent in plaintext. A good practice would be to hash it a first time on the client and another time on the server. That way, the server never ever know what the password is and if the communication is somehow compromised, the attacker doesn't have the plaintext password.
    – Simon
    Nov 9, 2019 at 1:00

2 Answers 2


It really depends on the service.

The most common is password-base authentication (and probably will stay like this for a long time). All this services you mentioned use TLS for encryption to mitigate possible MIM attacks.

What is becoming a common practice nowadays is to offer 2FA. A list of web-sites that already offer it: https://twofactorauth.org/

It is important to understand that it is one more layer of security and do not aim to replace password based authentication.

Additionally, most of services offer OAuth2 nowadays. For example, when you access the Stack Exchange using your Google account. Of course, you must authenticate in your Google account, using password based authentication.

Password authentication is widely used because came first and is more scalable than other methods. Let's say my server offers certificate authentication. If you want to authenticate to it, you must have a certificate that is signed by a Certificate Authority that my server trusts. You must buy and have this certificate installed in your computer too. This is not a simple configuration for most end-users in the internet.

There are some other methods that are used by enterprises, because they usually have all the infrastructure and the web-sites are only accessed inside the corporate network, for example: SAML2.0, Kerberos, JWT, etc.

  • Oauth2 is authorization service not authentication
    – Infra
    Mar 2, 2021 at 5:49
  • @Infra technically true, but even without explicitly following OIDC, almost everybody tacks authentication onto OAuth in practice. The fact that it can be used without providing authentication seems little more than historical commentary at this point.
    – CBHacking
    Nov 27, 2021 at 8:05

Which user authentication measures are used nowadays?

Simple Answer "Multi-factor Authentication"

Based on :

  1. Something you know
  2. Something You have
  3. Something you are
  4. Somewhere you are
  5. Somewhere you are not

Combining two or more factors defined on above User authentication can provide. It is always depend on service, device and information you are using.

Based on requirement you can use technologies you have mentioned.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .