Paul Leach wrote:
> ...
> That's a non-sequiter. It does not contradict Larry's statement at
> all.
No, but his statement implied that Digest is immune from passive
attacks, which for many/most of the current implementations it is NOT.
> Digest with a strong password is proof against passive attacks (such
> as sniffing). Basic isn't.
It has nothing to do with the "strength" of the password (what does
that even mean???), but it has everything to do with what level of
protection a server implementation provides, basically how often the
nonce value is changed and whether or not the server does message
body authentication.
The Apache Digest authentication module, for example, seems to accept
any incoming nonce value for authorization.
--
______________________________________________________________________
Michael Sweet, Easy Software Products mike at easysw.com
Printing Software for UNIX http://www.easysw.com