My question is pretty similar to : https://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure.
Basically, I want to write an API for my service that allow a user to log into it and grants them access to the rest of the API calls. I want the API to be hooked into with any technology, Android or IOS apps, or web clients.
Ideally, the login sequence would not share the password in cleartext even it was over SSL/HTTPS. I want to form a login authentication that can work over HTTP and than adding SSL/HTTPS adds an extra layer of security. I don't want SSL/HTTPS to be my only layer of security.
I was reading about HMAC authentication and this seemed like what I want to do because the shared secret is never sent over the wire. But the issue with this is it requires the client to save the shared secret, which doesn't work so well in an application because then it does not allow them to log out and log in to another account on the same device.
Is there any way I can implement login authentication without sharing the password over the wire or at the very least, sending it over the wire not in cleartext and with SSL/HTTPS.
Let me know if I need to explain more. Thanks!