Full Disclosure mailing list archives
Re: HTTP AUTH BASIC monowall.
From: Tim <tim-security () sentinelchicken org>
Date: Mon, 13 Mar 2006 14:46:46 -0500
Does anyone else feel that using HTTP BASIC AUTH for a firewall is a bad idea even if it is SSL'd. All basic auth does is creates a hash string for username:password using base64. That can easily be reversed and the real username and password extracted. Sure it's SSL but can't a crafty attacker just create a proxy of sorts on a compromised network and intercept the communications? Am I missing something here?
When you connect to an SSL website, how do you know you are even connecting to the right one in the first place? How do you know (or think you know) that someone isn't pulling a MitM attack like you describe every time you buy something online. Do you even know what you are placing your trust in? Obviously, someone at Netscape thought about this when they designed SSL. Of course, if your users just click OK every time they see a certificate warning box, then SSL is completely pointless. Basic auth is just fine over SSL against MitM attacks. It isn't perfect, but if you can trust your SSL, then you can trust basic auth not to fall victim to THAT attack. Same goes for cookies, which are just as clear-text in HTTP. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: HTTP AUTH BASIC monowall., (continued)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 15)
- Re: HTTP AUTH BASIC monowall. Dave Korn (Mar 15)
- Re: Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 15)
- Re: Re: HTTP AUTH BASIC monowall. greybrimstone (Mar 15)
- Re: Re: HTTP AUTH BASIC monowall. Dave Korn (Mar 16)
- Re: Re: Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 16)
- Re: HTTP AUTH BASIC monowall. Steffen Kluge (Mar 13)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 13)
- Re: HTTP AUTH BASIC monowall. Valdis . Kletnieks (Mar 14)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 14)
- Re: HTTP AUTH BASIC monowall. Jim Popovitch (Mar 13)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 13)
- Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 17)