full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Mar 13 19:46:54 2006
From: tim-security at sentinelchicken.org (Tim)
Subject: HTTP AUTH BASIC monowall.

>     Does anyone else feel that using HTTP BASIC AUTH for a firewall is a
> bad idea even if it is SSL'd. All basic auth does is creates a hash
> string for username:password using base64. That can easily be reversed
> and the real username and password extracted. Sure it's SSL but can't a
> crafty attacker just create a proxy of sorts on a compromised network
> and intercept the communications? Am I missing something here?

When you connect to an SSL website, how do you know you are even
connecting to the right one in the first place?  How do you know (or
think you know) that someone isn't pulling a MitM attack like you
describe every time you buy something online.  Do you even know what you
are placing your trust in?

Obviously, someone at Netscape thought about this when they designed
SSL.  Of course, if your users just click OK every time they see a
certificate warning box, then SSL is completely pointless.

Basic auth is just fine over SSL against MitM attacks.  It isn't
perfect, but if you can trust your SSL, then you can trust basic auth
not to fall victim to THAT attack.  Same goes for cookies, which are
just as clear-text in HTTP.

tim