Re: New Input type proposal

Harlan Messinger wrote:
> 
> But since the hash, not the password, is what gets access to the 
> application, how is this helpful?

Please! Reread my initial posting, all your questions should be answered 
there. All advantages are listed there.

> Having the value of a string called a 
> "password" is not an end in itself. The point is that the administrator 
> has the data he needs to get into the application.

Its not about getting into an application. This is always possible. Its 
about protecting the password and preventing replay attacks.

> And if you're talking 
> about a situation where the administrator has access to the application 
> itself (this isn't a given, but you've just added it to the scenario), 

It isnt a given? In most cases the Administrator has access to the 
application itself. Whether he is allowed to access it directly is 
another issue.

> then why does it matter at all whether the administrator can see the 
> password or the hash or anything else?

Password and Replay protection.

> 
> You mentioned addressing this with SSL. Your rationale for your approach

> was to ****eld the password from the administrator as well.

In terms of SSL, yes. But for HTTP it would also provide additional 
security layers.

> 
> OK, this is the first time you've mentioned the issue of the 
> administrator giving it to someone *else* instead of just knowing it 
> himself.

Not only necessarily to someone else, but also abusing it for other 
accounts of the user.

Alexander