The trouble with digest auth is it requires the password or a usable representation thereof to be stored in recoverable form. This means that if you can get a dump of a site's database, you can use the stored credential data to authenticate to that site, which isn't possible when you store hashed passwords.

This is better than transmitting passwords in the clear, but worse than transmitting them over an encrypted link.

Your point is correct but AFAIK your facts are incorrect.

Digest authentication can indeed store the password in hashed form. The problem is the the client doesn't need the plaintext password; this hashed form suffices.

See <http://en.wikipedia.org/wiki/Digest_access_authentication#Ad....

That's what I meant by 'a usable representation thereof' -- sufficient data for a client to be able to use it to authenticate.

Ya that wasn't very clear. Thanks for the downvote.

As far as I can tell, it's not possible for someone to down-vote a response to a comment they've made -- certainly I'm not able to.

Additionally, you'd need new browser APIs (AFAIK) to detect failed logins, render the login UI, etc. Otherwise, it's going to look out of place and confusing. Product managers are unlikely to accept the default browser/OS handling.

And digest auth means a DB dump has enough information to authenticate as a client, which is considerably worse for security if a server gets compromised.

Realistically the problem with that isn't even MD5, it's the modal popup that hasn't changed in any browser since 1999.

It's so unbelievably popular, Chrome copied the behavior despite not existing in 1999. It's all over mobile, too...

I wonder if the original reason for using a modal OS-level popup was to prove that it's not a fake prompt displayed by a malicious site.

Kinda. The important thing to note is that back in 1997, when the digest auth RFC was written, we recognised the hashing before going over the wire... and somehow we lost sight of that

The browser implementers completely punted on making HTTP authentication usable: there's no friendly way for a user to logout, for the server to force a logout, for the user to change a password, etc. All of these were well known and discussed from day one but they weren't seen a priority by any vendor and most web developers went with usability over security.