We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team:

Group 1 wants to adopt an approach that is more concerned about data leakage than MITM attacks:

  • Passwords will be sent in the clear in requests (but a MITM would therefore be able to recover a user's password).
  • Passwords will be obfuscated in a non-reversible way in the DB (bcrypt).

Group 2 feels that the risk of a MITM attack outweighs that of data leakage. Therefore:

  • Passwords will be sent in requests in digest form, so they cannot be recovered by a MITM.
  • As a result of using digests, the original password needs to be recoverable on the server so the digest can be recreated. Therefore passwords will be stored encrypted in the database.

While total security is obviously impossible, is there a third way that can have the best of both worlds? While Group 1's approach seems pretty orthodox, how common is Group 2's?

1 Answer 1


MITM attacks are effectively thwarted by HTTPS.

Since transport-level security can effectively protect you against eavesdropping and malicious interception, you should use TLS as your transport and focus your on securing the data at rest.

Group 2 was an popular about 20 years ago; it got some traction in the mail authentication world for a time, but with the popularity of SSL has declined significantly.

Group 1 is what everybody does today. In fact, it's a requirement of many standards.

  • Can MITM really be ignored as a risk when using TLS? Could you give some examples of standards that require something like Group 1's approach? Nov 7, 2013 at 7:56
  • With only the exception of disused protocols like HTTP digest authentication, everything is Group 1. Anyone you give your password to who hashes it server side is Group 1.
    – tylerl
    Nov 7, 2013 at 8:19
  • TLS does prevent MITM if certificates are properly validated, which is why certificates are signed. If TLS can't prevent MITM attacks, then it's utterly useless; no other benefits are of any value in the absence of that guarantee.
    – tylerl
    Nov 7, 2013 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .