[tomjen3]

Sure, but how many people are using it? You would need to verify the password on each request (since you can't use browser cookies).

[pjscott]

The operations npm needs to log in for are a fairly small percentage of the total. If you need to upload a new version of a package, then that takes a password. If you just need to search for a package, or download its latest version, those don't need authentication. The overhead from using proper slow password hashing would be minimal.

And evidently the CouchDB guys agree with me, because they switched to using PBKDF2 for password storage -- essentially, iterate SHA several thousand times to make it slower.

[grandpoobah]

Wouldn't npm client be sending the hashed version of the password rather than the password itself? then the server only has to compare the two hashes.