6 ms·
> ...Which is why I said "over a secure connection". ... and how do you set up a secure connection without a pre-existing password? Your solution has a chicke
by josai 11y ago
> ...Which is why I said "over a secure connection".
... and how do you set up a secure connection without a pre-existing password?
Your solution has a chicken-and-egg problem.
- TheLoneWolfling 11y agoHTTPS, the same way everything else solves this problem.
- jimktrains2 11y agoHTTPS doesn't solve the problem of not having to send the plaintext password to the server. SRP does. [0] http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
- jimktrains2 11y agoSRP (e.g. TLS-SRP) doesn't require the server to have the plaintext password. [0] http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
- josai 11y agoThe guy I was replying to was arguing against SRP and proposing his own ad-hoc solution.