[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [Very OT] IIS Basic Authentication can be used for phishing





David Dorward wrote:
On Wed, 10 Nov 2004 07:13:56 +0000, Upayavira <uv@upaya.co.uk> wrote:

Just learned IIS Basic authentication

How is this different from Apache's basic authentication


It isn't - Basic Authentication is part of the HTTP standard.
To quote: "The basic authentication scheme is a non-secure method of
filtering unauthorized access to resources on an HTTP server. It is
based on the assumption that the connection between the client and the
server can be regarded as a trusted carrier. As this is not generally
true on an open network, the basic authentication scheme should be
used accordingly"
  - http://www.w3.org/Protocols/HTTP/1.0/draft-ietf-http-spec.html#BasicAA


That may be so, but isn't it the fact that IE gives the credentials of the currently logged on user straight away, not defaulting to asking for a username and pass first.



Reply to: