I am not going to comment on the security side of things here, since as others already commented: you do not win much security wise. If you are worried about plaintext password leaks via MITM, use TLS - period
On Saturday, January 14, 2017 at 7:24:24 PM UTC+1, Chris Priest wrote: > > Has anyone ever tried building an authentication system that worked this > way? If someone built such a thing, could it get included in django contrib? > Yes, there are plenty of such systems out there. The chances of including that in django.contrib are roughly zero, first and foremost Django auth backends do not depend on frontend stuff, ie cannot rely on JS being available. And without sub-resource integrity and end-to-end visibility of that integrity there is no way I see such a system to be useful. TLS+cleartext password or SPNEGO are imo the way to go forward. Cheers, Florian -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/b7b49d53-6dc7-4e58-a2e6-0dfce2d1a0b0%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
