On: Using HTTP Basic Auth in 2022

[Too]

The hash is not constant.

With public key crypto you can implement a challenge response. Server generates random garbage, send to client, client signs the garbage using priv key, sends it back as a hash that the server can verify using pub key.

Another version of this is with shared secrets instead of public/private, by replacing the signature with simply HMAC(secret, garbage) and keep rest of flow same as above.

[staticassertion → Too]

Yeah, once you get to the ZKP approach, which is what you're describing, the benefits are more significant.

[u801e → Too]

> With public key crypto you can implement a challenge response.

Or just use a client side TLS certificate to authenticate instead of or in addition to the username and password.