Re: Digest Authentication

"Matt Schroebel" <MSchroebel@hsus.org> wrote in message news:D4DB668A680B2549AE977FB0B193E2E80424AC@email.hsus.org... > > You can read what the Apache Group has to say about Digest Authentication at: > http://httpd.apache.org/docs/howto/auth.html#digest > > It's not really any better the Basic. While user/password is encryted the data is still sent in cleartext. And if someone captures the encrypted user/password values, they can send it and get the page. Actually, it is better in at least one respect. Since many people tend to use the same password for multiple sites/services, Digest does not allow someone to see the original password. Yes, they may be able to use the hashed version to gain access to a single service, but that would be it. Also, from what I read in the RFC (http://www.merit.edu/internet/documents/rfc/rfc2617.txt), there are techniques to limit replay attacks (even stop them entirely if you don't mind the overhead). I am not saying that the use of Digest Authentication is ideal, but it is an improvement over Basic authentication and much less costly when SSL (esp. when SSL is overkill for my needs). --- Seairth Jacobs seairth@seairth.com