2 ms·
Ok, so digest authentication is safe against this new firefox extension? If so, why don't facebook et al. switch to digest based authentication? Surely its be
by al_james 16y ago
Ok, so digest authentication is safe against this new firefox extension?
If so, why don't facebook et al. switch to digest based authentication?
Surely its better than unencrypted cookie based logins. Is it just that its ugly (the browser login popup)?
- pornel 16y agoYes, Digest is safe in this case, but one could write a more advanced (packet-injecting) tool/Firefox extension that breaks Digest too. Terribly bad UI and lack of standard way to log out are dealbreakers for HTTP auth. There's also no reliable way to customize UI to offer help, password reminders, branding or anything like that. There has been proposal to improve this in 1999: http://www.w3.org/TR/NOTE-authentform http://www.w3.org/TR/NOTE-authentform and recently discussed in HTML5 WG, but the conclusion was Digest and countless JS tricks proposed in its place are only partial solutions, cookies have unstoppable momentum, so it's better if everyone just switches to SSL.