Re: [Very OT] IIS Basic Authentication can be used for phishing

[Upayavira <uv@upaya.co.uk>]

William Ballard wrote:

> Just learned IIS Basic authentication transmits
> a users user name and password in Base64 over the internet.
>
> MS recommends you use SSL with it.
>
> But, even if you do that, can't you use an ISAPI
> to silently phish somebody's password?  Or even if the dialog
> comes up, Granma and Granpa will hit okay.
>
> Hm.  Sorry, I know it's very OT, but I don't want to subscribe
> to a security list just to make this one observation.
>
> Any thoughts?
>  
How is this different from Apache's basic authentication, which I 
believe also passes user/pass information as plain text?

You should use SSL with Apache too.

Regards, Upayavira