Simon Smith wrote:
> List,
> Does anyone else feel that using HTTP BASIC AUTH for a firewall is
> a bad idea even if it is SSL'd. All basic auth does is creates a hash
> string for username:password using base64. That can easily be reversed
> and the real username and password extracted. Sure it's SSL but can't
> a crafty attacker just create a proxy of sorts on a compromised
> network and intercept the communications? Am I missing something here?
Several things.
Probably most important of all is that this authentication only travels
between you and your local network firewall. Any attacker would have to be
/inside/ your firewall already to MITM you. And you'd have to ignore all
the warnings from your browser about the invalid SSL certificate. And
hashes can't be 'easily' reversed, but then again it's not a hash at all,
it's just an encoding.
cheers,
DaveK
--
Can't think of a witty .sigline today....
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
