revelate

Having just seen this it at work for a startup we helped launch, I strongly recommend (without giving too much away):

5) Makes sense for other companies to promote to their customers. Ideally ones with lots of customers.

Bonus points: your product fits in to their customer acquisition process (i.e. helps generate more revenue for them).

Triple bonus points: you have access to a large number of these companies through a small number of entry points. For instance a trade association or a friend that will introduce you.

You wouldn't believe how easy it is to get your product out there in the above situation. PR is the last thing you worry about.

HTTP Digest support pretty much requires you to hash passwords using MD5(salt:password), if there’s a way to support HTTP Digest while storing bcrypt hashed passwords I’d love to know.

Why do we care about HTTP Digest? It provides a standard technique to avoid sending clear passwords from client to server. This is particularly handy when the client server communication isn’t encrypted (a poor man’s SSL if you will), but sounds like a good idea in general.

In principle you could create a variant of HTTP Digest using bcrypt instead of MD5 however you’d break browser and rss reader compatibility and AFAIK there are currently no javascript bcrypt implementations.

Hence I’m guessing that web apps storing bcrypt hashed passwords are forced to send clear-ish passwords from client to server and therefore must rely on the presence of an ssl/https connection.

Obviously ssl should be used whenever possible, but I wonder to what extent sending clear passwords doesn’t create other forms of vulnerability?

We implemented http digest authentication (http://en.wikipedia.org/wiki/Digest_access_authentication) in our application for the following reasons: - We needed to securely authenticate users connecting with browsers and rss readers without ssl. - We needed an encryption algo that we could implement in javascript so as to provide reasonably secure login without ssl.

Is there any way to do the above while storing bcrypt passwords on the server? Does using bcrypt in these scenarios force you to use https and pass full text passwords to the server?