RE: RE: Encoding charset of HTTP Basic Authentication
Were back to the problem that SSL doesn't solve the problem (today) it was originally intended to solve. But it happens to solve *this* problem (as long as you ignore the fact that both ends may be insecure - in which case all bets are off). But yes the crux is that Authentication in pure HTTP is either insecure or hard. That's just the way it is (as far as I know). <rant> This is why a particular annoyance of mine is the false-sense-of-security of CA signed certificates. If browsers didn't put up an ugly warning about how scary a self-signed certificate was then more people would use SSL and the internet would be more secure. But if you use plain HTTP you don't get a warning - just insecurity. Why is it like this ? My only guess ... "Follow the money ..." ? </rant> ---------------------------------------- David A. Lee firstname.lastname@example.org http://www.xmlsh.org -----Original Message----- From: Petite Abeille [mailto:email@example.com] Sent: Monday, January 30, 2012 9:18 AM To: xml-dev Subject: Re: RE: Encoding charset of HTTP Basic Authentication On Jan 30, 2012, at 2:52 PM, Pete Cordell wrote: > A quick question before I do though, does Digest require the server to have access to the password in clear text form, whereas Basic allows the server to store the password in some hashed form? That's the crux of it: digest is not worth the complications IMO. If you care about the integrity of the transport channel, use TLS. If you use TLS, basic is all what you need. _______________________________________________________________________ XML-DEV is a publicly archived, unmoderated list hosted by OASIS to support XML implementation and development. To minimize spam in the archives, you must subscribe before posting. [Un]Subscribe/change address: http://www.oasis-open.org/mlmanage/ Or unsubscribe: firstname.lastname@example.org subscribe: email@example.com List archive: http://lists.xml.org/archives/xml-dev/ List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]
PURCHASE STYLUS STUDIO ONLINE TODAY!
Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!
Download The World's Best XML IDE!
Accelerate XML development with our award-winning XML IDE - Download a free trial today!
Subscribe in XML format