IPP> Re: PRO - Issue 32: Use of Basic & Digest Authentication

IPP> Re: PRO - Issue 32: Use of Basic & Digest Authentication

IPP> Re: PRO - Issue 32: Use of Basic & Digest Authentication

Michael Sweet mike at easysw.com
Mon Apr 12 13:41:38 EDT 1999


Paul Leach wrote:
> ...
> That's a non-sequiter. It does not contradict Larry's statement at
> all.

No, but his statement implied that Digest is immune from passive
attacks, which for many/most of the current implementations it is NOT.

> Digest with a strong password is proof against passive attacks (such
> as sniffing). Basic isn't.

It has nothing to do with the "strength" of the password (what does
that even mean???), but it has everything to do with what level of
protection a server implementation provides, basically how often the
nonce value is changed and whether or not the server does message
body authentication.

The Apache Digest authentication module, for example, seems to accept
any incoming nonce value for authorization.

-- 
______________________________________________________________________
Michael Sweet, Easy Software Products                  mike at easysw.com
Printing Software for UNIX                       http://www.easysw.com



More information about the Ipp mailing list