It's my understanding that the purpose of
.htpasswd files is to restrict access to some files in the server filesystem. If an attacker gains access to it, he probably has access to everything else too, so it seems like there's little point in using a slow hash in this situation (would only increse the server load). However, I've just seen that Apache 2.4 introduced support for
bcrypt in these files:
*) htpasswd, htdbm: Add support for bcrypt algorithm (requires apr-util 1.5 or higher). PR 49288. [Stefan Fritsch]
The feature request does not offer any explanation about why using a simpler hash make "passwords stored in those hash functions vulnerable to cracking". Is this just "paranoia" or is there a good reason for using a stronger hash in this scenario?