full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060316155804.4bb015db.fx@sabre-labs.com>
Date: Fri Mar 17 15:40:42 2006
From: fx at sabre-labs.com (Felix Lindner)
Subject: HTTP AUTH BASIC monowall.

Hi,

On Thu, 16 Mar 2006 09:48:07 -0500
Simon Smith <simon@...soft.com> wrote:
> My first thought was on how to harden the
> authentication because the basic auth didn't cut it for me. Thats what I
> am looking for ideas for.

you may be looking for Digest Authentication:
http://www.ietf.org/rfc/rfc2617.txt:

   "Like Basic, Digest access authentication verifies that both parties
   to a communication know a shared secret (a password); unlike Basic,
   this verification can be done without sending the password in the
   clear, which is Basic's biggest weakness. As with most other
   authentication protocols, the greatest sources of risks are usually
   found not in the core protocol itself but in policies and procedures
   surrounding its use."

cheers
FX

-- 
SABRE Labs                 | Felix 'FX' Lindner <fx@...re-labs.com> 
http://www.sabre-labs.com  | +49 171 7402062
                           | A740 DE51 9891 19DF 0D05  
                           | 13B3 1759 C388 C92D 6BBB