Hacker News new | ask | show | jobs
by jarito 5066 days ago
They will just check your password against a list of 'bad' passwords when you log in. No need to brute force the stored hash.
2 comments
wizardishungry 5066 days ago
A little bit of googling makes it seem like auth tokens are not sent it plaintext over HTTPS but are authenticated using challenge response – http://forums.dropbox.com/topic.php?id=47952 The WWW site may differ.
link
wizardishungry 5066 days ago
Obviously that would work, but not if you're using Challenge-response authentication. In general, I don't think people bother with now that when using https.
link