On Thu, 2002-02-28 at 12:48, Tim Roberts wrote:
> >Ng's authcookie extension to m2crypto sounds perfect for this sort of
> >stuff, but I have tested it yet.
>
> I, for one, am very interested in hearing others experience and advice on this
> topic. Every site I've ever done has wanted username/password protection at
> some point. I would love to find some middle ground between plain-text
> passwords and the expense and hassle of getting a certificate for https.
> Plain-old HTTP authorization is workable, but as was pointed out earlier, it
> suffers from terminal ugliness.
Plain HTTP authentication sends in plaintext as well -- digest HTTP
authentication does not, but only IE5+ supports it (I think) -- all
WebDAV clients support digest, though (AFAIK).
Anyway, you can have the client hash the password with Javascript. I've
tested this successfully, but never used it seriously. I've played
around with this in FFK.
There's JS code here:
http://pajhome.org.uk/crypt/md5/
But I can't access the site at the moment.
Ian
|