4 ms·
You used to be able to put HTTP basic authentication into the URL in the format http://username:password@hostname-or-ip.example.com/ http://username:password@ho
by 0x0 9y ago
You used to be able to put HTTP basic authentication into the URL in the format http://username:password@hostname-or-ip.example.com/ http://username:password@hostname-or-ip.example.com/ - modern browsers are removing support for the "username:passord@" part because people would put a legit domain in the username:password@ part to fool users. (i.e., http://cnn.com:article123456@fakenews.example.com/ http://cnn.com:article123456@fakenews.example.com/ which would actually take you to fakenews.example.com while sending a username of "cnn.com" and a password of "article123456")
- mschuster91 9y agowhat? O.o I use this in Keepass to store quick-login links for some that still require http basic auth (though, haven't tested these for a while). Do you have any link on the deprecation?
- 0x0 9y agohttps://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Access_using_credentials_in_the_URL https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentica...
- jwilk 9y ago> In Firefox, it is checked if the site actually requires authentication and if not, Firefox will warn the user with a prompt "You are about to log in to the site “www.example.com” with the username “username”, but the website does not require authentication. This may be an attempt to trick you.". Huh, that's just security theater. The phisher could set up a website that does require authentication, thereby avoiding the warning. The sensible thing to do would be to display the warning if the username contains unescaped dots. (I.e., http://cnn.com:article123456@fakenews.example.com/ http://cnn.com:article123456@fakenews.example.com/ would provoke warnings, but http://cnn%2Ecom:article123456@fakenews.example.com/ http://cnn%2Ecom:article123456@fakenews.example.com/ would not.)
- jchw 9y agoThinking about this, I think you're right that this is perhaps less useful than billed. If anything though, I'd rather have both warnings.
- deleted 9y ago[deleted]
- jaimex2 9y agoStrange, it still works for me on Chrome on a http site.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- theEXTORTCIST 9y agoI just tried this on Chrome 60.0.3112.90. Both Firefox and Safari throw phishing warnings with these URLs. http://news.ycombinator.com@1572395042 http://news.ycombinator.com@1572395042 Chrome takes me to 93.184.216.34 no warning Then I tried http://security.wellsfargo.com@customerLoginv=ar3351RandomData=03hf02hf0waih0fihq204th0q2i4hg0i4h-40ih04gih0q4i4-24ih0ggq43930gi0q34g0-g9q4@1572395042@badsite.null/ http://security.wellsfargo.com@customerLoginv=ar3351RandomDa... Which stretches way past my laptops viewable URL bar... and it takes me right to badsite.null (or a valid site like example.com). If you need HTTPs you can redirect on badsite.null's web server. Very wild.