full-disclosure - Re: HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Mar 15 20:44:14 2006
From: davek_throwaway at hotmail.com (Dave Korn)
Subject: Re: HTTP AUTH BASIC monowall.

Simon Smith wrote:
> List,
>    Does anyone else feel that using HTTP BASIC AUTH for a firewall is
> a bad idea even if it is SSL'd. All basic auth does is creates a hash
> string for username:password using base64. That can easily be reversed
> and the real username and password extracted. Sure it's SSL but can't
> a crafty attacker just create a proxy of sorts on a compromised
> network and intercept the communications? Am I missing something here?

  Several things.

  Probably most important of all is that this authentication only travels 
between you and your local network firewall.  Any attacker would have to be 
/inside/ your firewall already to MITM you.  And you'd have to ignore all 
the warnings from your browser about the invalid SSL certificate.  And 
hashes can't be 'easily' reversed, but then again it's not a hash at all, 
it's just an encoding.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....