So I was just thinking about
token_authenticatable setup from devise (rails gem), and this thought occurred to me:
Obviously we should always use SSL, but even SSL is vulnerable to MITM attacks, wouldn't it be safer if, instead of a password, web servers stored a hash of the username and password, so that even if a user's login hash was recovered, it would only work on one website. Right?
Because lets say that joe shmoe has his gmail account, with a username of [email protected] and a password of joeshmoe. Now Mr. Shmoe signs up with mylazywebsite.com which doesn't use SSL, using the same password as his gmail account, now his whole online identity has been compromised.