full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Mar 13 20:24:13 2006
From: michael.holstein at csuohio.edu (Michael Holstein)
Subject: HTTP AUTH BASIC monowall.

> Does anyone else feel that using HTTP BASIC AUTH for a firewall is a
> bad idea even if it is SSL'd. All basic auth does is creates a hash
> string for username:password using base64. That can easily be reversed
> and the real username and password extracted. Sure it's SSL but can't a
> crafty attacker just create a proxy of sorts on a compromised network
> and intercept the communications? Am I missing something here?

If it's Basic via SSL, then it's fine. Nobody will be able to intercept it.

It is possible to setup a MITM attack using SSL, but you've got to use a 
forged certificate and the browser will alert as to such. The problem 
there lies in the fact that most users will blindly click "ok" to such a 
dialouge.

You said this is a firewall box. Most "appliances" I've seen use 
self-signed SSL certs which don't validate anyway -- so you're ALREADY 
used to clicking "ok" on the warning. Therein lies the danger I suppose.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University