IPP> Re: PRO - Issue 32: Use of Basic & DigestAuthentication

IPP> Re: PRO - Issue 32: Use of Basic & DigestAuthentication

Michael Sweet mike at easysw.com
Mon Apr 12 13:25:25 EDT 1999


Larry Masinter wrote:
> ...
> > 2. Its secure
> 
> No, it has serious security problems in the context of a printing
> protocol. Maybe "its secure" for web browsing, but requiring the
> printer to hold passwords in the clear leads to several

And why would it need to?  Most HTTP servers support encrypted 
passwords using the UNIX crypt() function (this allows you to use the
server's main password file or a separate one).  As long as you have
the original password text you can use ANY server-side encryption/
hashing on the password value you like (unlike Digest).

> ...
> Frankly, it seems like we're getting some knee-jerk responses.
> This isn't a popularity contest. The results actually have to
> work.
> ...

OK, so (besides IE5, which just came out) how many existing HTTP
clients support the full range of Digest options in the final HTTP
1.1 draft standard?  I bet not many.

Basic has been supported for years...

-- 
______________________________________________________________________
Michael Sweet, Easy Software Products                  mike at easysw.com
Printing Software for UNIX                       http://www.easysw.com



More information about the Ipp mailing list