All Questions
3 questions
0
votes
1
answer
222
views
Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?
I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers.
However if I REALLY need to use JSONP to submit a ...
- 101
18
votes
4
answers
13k
views
HTTP Basic auth password storage more secure than Digest auth
If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
- 2,978
48
votes
4
answers
13k
views
What to transfer? Password or its hash?
Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever).
Upon login, what should I transfer over the network and why? Password ...
- 755