Re: Are http-based password authentications secure?

On Tuesday 25 April 2006 18:53, Scott Lamb wrote:
> And if you're worried about man-in-the-middle attacks, it depends on
> how you set up the *client*. If it allows the server to request basic
> authentication, then "http://" is not secure. I don't think
> Subversion has a way to prevent basic auth from being used (most http
> clients don't), so "https://" is a more secure choice.

As far as I know the protocol digest auth via http does not prevent
man-in-the-middle - it only prevents the man in the middle from snooping
the password - he can still modify the data transmitted.

So maybe the password is transferred securely, but you didn't gain much.

Use https. Todays servers (even the small ones) are strong enough to do the
crypto overhead without complaint.

        Konrad